Skip to main content

Bolt.new + v0 guide

Your Bolt or v0 app
sends email, SMS and WhatsApp.

One prompt, one server route, one API call: the same message goes out by email, WhatsApp and SMS from your own mailbox, number and Android phone, and the key never reaches the browser.

Get a free API keyTypeScript SDK guide

In a hurry? Summarize this article with an AI

The short answer

How do you add email, SMS and WhatsApp to a Bolt.new or v0 app?

Have Bolt.new or v0 write a server-side route, a Next.js route handler or a Bolt server function, that sends POST https://api.unlimitedmessaging.app/message with an API key read from a server environment variable. One request reaches an inbox, a WhatsApp chat and a phone, from your own accounts, on a free plan with no credit card.

v0 generates Next.js apps that deploy on Vercel, and Bolt.new generates full-stack projects, often Next.js or Vite with Bolt Database or Supabase. Both can write server code. That matters, because a messaging key must never sit in the browser bundle: the send belongs in code that runs on the server.

Unlimited Messaging is a messaging API that sends from accounts you already own: email from your Gmail or domain mailbox over IMAP/SMTP, WhatsApp from your own number linked like WhatsApp Web, SMS from your Android phone's SIM through a free app. There is no per-message fee on the free plan; messages carry a short "Sent with UnlimitedMessaging.app" line.

The point for a vibe-coded app is speed. Instead of three providers, three SDKs and three verifications, the AI builder writes one fetch call, and you test with real messages the same afternoon.

Typed client for Node.js and Next.js: the TypeScript SDK. Several channels in one call: email and WhatsApp in one API request. SMS from your phone: the Android app.

Illustration: a grid of small icons with one highlighted, with the headline “Bolt and v0 apps that message users”.

Why not hand-code it

Why does hand-coding email, SMS and WhatsApp take so long?

AI builders write the code in seconds. The slow part is everything around it: providers, verification, policies and deployment quirks.

  1. Email: SMTP is awkward on serverless hosts

    Vercel blocks outgoing SMTP on port 25 and recommends an email API for most cases, and Supabase Edge Functions refuse ports 25 and 587 altogether. An email API then asks for a verified domain and DNS records before it delivers to anyone but you.

  2. SMS: numbers, registration, per-segment fees

    A provider like Twilio rents you a number and bills each segment, $0.0083 in the US plus carrier fees. US traffic from a regular long code needs A2P 10DLC registration, starting with a $4.50 brand fee and vetting.

  3. WhatsApp: templates and limits

    Meta's official Cloud API requires an approved template for anything sent outside the 24-hour customer service window, reviewed within 24 hours, priced per template message, with new accounts capped at 250 unique recipients per 24 hours.

  4. More code for the AI to get wrong

    Three SDKs and three webhook formats mean more files, more keys and more places where a generated snippet leaks a secret or swallows an error. One endpoint keeps the diff small enough to review.

Side by side

Which messaging stack fits a Bolt.new or v0 app?

What each common option needs before your app can message a real user.

Which messaging stack fits a Bolt.new or v0 app?
Nodemailer + SMTPDIY emailResendEmail APITwilioSMS and WhatsApp APIUnlimited MessagingEmail, SMS and WhatsApp API
ChannelsEmailEmailSMS and WhatsAppEmail, WhatsApp and SMS in one request
Cost to testFree with your own mailboxFree: 3,000 emails a month, 100 a dayTrial credit, then per messageFree plan, no per-message fee, footer line
Works in serverless functionsDepends on the host's port rulesYes, HTTPSYes, HTTPSYes, HTTPS
Setup before real usersSMTP credentialsVerified domain and DNSNumber, 10DLC (US), Meta setup for WhatsAppLink mailbox, scan a QR code, install the Android app
Inbound repliesBuild your own IMAP pollingDelivery event webhooksWebhooksInbox on every plan, webhooks on paid plans
ScaleYour mailbox's limitsBuilt for volumeBuilt for volumeHuman pace, no bulk; unofficial WhatsApp

Prices and limits from each vendor's own page, checked on 9 November 2026.

Step by step

From zero to a first message in five steps

  1. 01

    Create a free account

    Sign up at app.unlimitedmessaging.app with Google, GitHub or your email address. No credit card; the Free plan is permanent.

  2. 02

    Connect your channels

    Add your mailbox over IMAP/SMTP, scan a QR code to link WhatsApp, and install the Android app on a phone with a SIM for SMS. Start with one if you like.

  3. 03

    Create an API key

    Open the API section of the dashboard and create a key. Copy it once.

  4. 04

    Add UM_API_KEY on the server side

    v0: Project menu, Settings, Environment Variables, with Development ticked so the preview sees it. Bolt: the Secrets panel (database icon) for server functions, or the gear menu on a Supabase project.

  5. 05

    Paste the prompt

    The builder writes the route and the call. Test on your own number and inbox before any real user.

Copy, paste

What prompt do you paste into Bolt.new or v0?

Paste this into the chat. It asks for a server-side route, the key from the environment and an order confirmation. Swap in your own trigger.

Prompt for Bolt.new or v0Prompt
Add messaging to this app with Unlimited Messaging (REST API, docs: https://docs.unlimitedmessaging.app).

1. Create a server-side route: in Next.js, app/api/notify/route.ts (or a server action); in a Vite app on Bolt, a server function. Never call the API from client components.
2. Read the key from the environment variable UM_API_KEY. Do not prefix it with NEXT_PUBLIC_ or VITE_, do not hardcode it, and tell me where to add it (v0: Settings > Environment Variables; Bolt: Secrets).
3. Send POST https://api.unlimitedmessaging.app/message with "Authorization: Bearer <UM_API_KEY>" and the JSON body { "to": { "phone": "<E.164>", "email": "<email>" }, "subject": "...", "text": "...", "channels": [{ "channel": "EMAIL" }, { "channel": "WHATSAPP" }, { "channel": "SMS" }] }.
4. Only message the signed-in user, with their contact details read on the server. Return the API status and body so errors are visible.
5. Trigger it after checkout with an order confirmation, and ask me for my own number and email for a first test.
The endpoint is plain HTTPS: the same prompt fits Lovable, Cursor or Claude Code with a different first step.
POST /api/notifyNext.js
// app/api/notify/route.ts
export async function POST(req: Request) {
  const { phone, email, name } = await req.json();

  const res = await fetch('https://api.unlimitedmessaging.app/message', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.UM_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      to: { phone, email },
      subject: 'Your order is confirmed',
      text: `Thanks ${name}, your order is on its way.`,
      channels: [{ channel: 'EMAIL' }, { channel: 'WHATSAPP' }, { channel: 'SMS' }],
    }),
  });

  return Response.json(await res.json(), { status: res.status });
}
The route handler the builder should produce. In production, take the phone and email from your database for the signed-in user, not from the request body. Remove channels you have not connected.
@unlimited-messaging/sdkTypeScript
import { UnlimitedMessagingApiClient } from '@unlimited-messaging/sdk';

const um = new UnlimitedMessagingApiClient({ token: process.env.UM_API_KEY! });

// Server-side only: a route handler, a server action or a server function
await um.messages.messageSend({
  recipient: '+33612345678',
  text: 'Your code is 291847, valid 5 minutes.',
});
The typed SDK (npm i @unlimited-messaging/sdk) for single-channel sends from server code. For several channels in one call, the REST body on the left is the reference.

Safety

Where should the API key live in Bolt.new and v0?

In server-side environment variables, read only by server code. Both tools document the same rule.

  1. v0: no NEXT_PUBLIC_ prefix

    v0's security docs state that only variables prefixed with NEXT_PUBLIC_ reach the browser, and that the others stay on the server. Name it UM_API_KEY and read it in a route handler or server action.

  2. v0: tick Development for the preview

    Variables are encrypted and stored on Vercel. The v0 preview only sees variables available to the Development environment, so add the key there too while you build.

  3. Bolt: Secrets, used by server functions

    Bolt's docs say secrets only work with server functions, which run on Bolt's servers rather than in the visitor's browser. On a Supabase-backed project, open Secrets from the gear menu.

  4. Never a VITE_ variable

    In a Vite app, anything prefixed VITE_ is compiled into the JavaScript the browser downloads. A messaging key there lets anyone send from your number and mailbox.

  5. No open relay

    A public route that sends any text to any number is a spam gateway with your name on it. Require a session, look the recipient up on the server and limit sends per user.

Replies

How do you receive replies in a Bolt.new or v0 app?

Every plan shows replies in the Unlimited Messaging inbox: email threads, WhatsApp chats and SMS received by the Android app. Pushing them to your own app takes webhooks, included in the paid plans: Medium at €19 a month and Max at €29 a month.

Ask the builder for a second route, for example app/api/um-webhook/route.ts, register its public URL on the Webhooks page of the dashboard, and subscribe to message.received and message.status. Read the raw body with await req.text() before parsing it, because the signature covers the exact bytes.

Deliveries follow the Standard Webhooks spec, signed with HMAC-SHA256 in the webhook-signature header. Reply 2xx within 10 seconds, then do the work. Failed deliveries are retried for a little more than 3 days, so deduplicate on eventId.

message.receivedJSON
{
  "type": "message.received",
  "eventId": "whd_...",
  "occurredAt": "2026-11-09T10:00:01.000Z",
  "data": {
    "channel": "WHATSAPP",
    "message": {
      "text": "Yes, see you Monday!"
    }
  }
}
A message.received event, shortened. data.message holds the sender, the text and, for email, the subject and attachments.
verify-webhook.tsTypeScript
import { createHmac } from 'node:crypto';
import { Buffer } from 'node:buffer';

// Standard Webhooks signature check, before trusting the body.
export function isValid(rawBody: string, h: Headers, secret: string) {
  const id = h.get('webhook-id');
  const ts = h.get('webhook-timestamp');
  const sig = h.get('webhook-signature') ?? '';
  if (!id || !ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = createHmac('sha256', key)
    .update(`${id}.${ts}.${rawBody}`)
    .digest('base64');
  return sig.split(' ').some((s) => s === `v1,${expected}`);
}
Signature check for a Next.js route handler or a Bolt server function. Keep the whsec_ secret in a second server variable, UM_WEBHOOK_SECRET.

Limits

What are the limits, honestly?

Unlimited Messaging sends from personal accounts, at a human pace. Plan for that before you launch.

  1. WhatsApp is unofficial

    Your number is linked as a device, like WhatsApp Web, outside Meta's Business Platform. Unsolicited messages get numbers banned. If you need official WhatsApp at scale, use Meta's Cloud API.

  2. Email follows your mailbox

    A personal Gmail account sends up to 500 emails a day. For newsletters or large volumes, an email service provider with a sending domain is the right tool.

  3. SMS at Android's pace

    Android asks for confirmation beyond 30 SMS in 30 minutes, so the app spaces sends out. Texts count against your carrier plan, and the sending phone must run Android.

  4. Free plan trade-offs

    Messages on Free end with "Sent with UnlimitedMessaging.app". Media, voice messages and webhooks come with Medium and Max, which also drop the footer.

FAQ

Questions about messaging from Bolt.new and v0

Sources

Sources & references

To check the information in this article for yourself:

  1. Security (only NEXT_PUBLIC_ variables reach the browser)v0 documentation
  2. External APIs (environment variables encrypted and stored on Vercel)v0 documentation
  3. Environment variablesVercel documentation
  4. Can I use SMTP with Vercel? (port 25 blocked)Vercel Knowledge Base
  5. Secrets (only work with server functions)Bolt support
  6. Server functionsBolt support
  7. Supabase integrationBolt support
  8. Route handlersNext.js documentation
  9. Edge Function limits (ports 25 and 587 not allowed)Supabase documentation
  10. Resend pricing (Free: 3,000 emails a month, 100 a day)Resend
  11. SMS pricing in the United States ($0.0083 per segment)Twilio
  12. A2P 10DLC Brand Registration ($4.50 brand fee)Twilio
  13. Message template review (decision within 24 hours)Meta for Developers
  14. WhatsApp messaging limits (250 unique recipients per 24 hours to start)Meta for Developers
  15. Limits for sending and getting mail (500 emails a day)Gmail Help
  16. SmsUsageMonitor (30 SMS in 30 minutes threshold)Android Open Source Project
  17. Standard Webhooks specificationStandard Webhooks
Ilian, senior software engineer

Written by

· Senior Software Engineer

A senior software engineer, he founds and runs several tech companies. He builds products around messaging APIs, automation and AI integration, and shares here what he learns while building.

View LinkedIn profileUpdated

Let your app talk to users today.

Create a free account, connect a mailbox, a number or a phone, and paste the prompt into Bolt.new or v0.

Get a free API key