# Bolt.new and v0: send email, SMS and WhatsApp for free? > A Next.js route handler and one prompt: your Bolt.new or v0 app sends email, SMS and WhatsApp from your own accounts. Free plan, no credit card. Source: https://unlimitedmessaging.app/articles/bolt-v0-email-sms-whatsapp Bolt.new + v0 guide # Your Bolt or v0 app _sends email, SMS and WhatsApp._ One prompt, one server route, one API call: the same message goes out by email, WhatsApp and SMS from your own mailbox, number and Android phone, and the key never reaches the browser. [Get a free API key](https://app.unlimitedmessaging.app)[TypeScript SDK guide](https://unlimitedmessaging.app/articles/typescript-sdk) The short answer ## How do you add email, SMS and WhatsApp to a Bolt.new or v0 app? Have Bolt.new or v0 write a server-side route, a Next.js [route handler](https://nextjs.org/docs/app/building-your-application/routing/route-handlers) or a Bolt server function, that sends POST https://api.unlimitedmessaging.app/message with an API key read from a server environment variable. One request reaches an inbox, a WhatsApp chat and a phone, from your own accounts, on a free plan with no credit card. v0 generates Next.js apps that deploy on Vercel, and Bolt.new generates full-stack projects, often Next.js or Vite with Bolt Database or Supabase. Both can write server code. That matters, because a messaging key must never sit in the browser bundle: the send belongs in code that runs on the server. Unlimited Messaging is a messaging API that sends from accounts you already own: email from your Gmail or domain mailbox over IMAP/SMTP, WhatsApp from your own number linked like WhatsApp Web, SMS from your Android phone's SIM through a free app. There is no per-message fee on the free plan; messages carry a short "Sent with UnlimitedMessaging.app" line. The point for a vibe-coded app is speed. Instead of three providers, three SDKs and three verifications, the AI builder writes one fetch call, and you test with real messages the same afternoon. Typed client for Node.js and Next.js: [the TypeScript SDK](https://unlimitedmessaging.app/articles/typescript-sdk). Several channels in one call: [email and WhatsApp in one API request](https://unlimitedmessaging.app/articles/email-whatsapp-single-api-request). SMS from your phone: [the Android app](https://unlimitedmessaging.app/channels/sms). ![Illustration: a grid of small icons with one highlighted, with the headline “Bolt and v0 apps that message users”.](https://unlimitedmessaging.app/_next/image?url=%2Fassets%2Farticles%2Fcovers%2Fbolt-v0-email-sms-whatsapp-en.png&w=3840&q=75) Definition Route handler A Next.js file (app/api/.../route.ts) that answers HTTP requests on the server. It can read any environment variable, while the browser only ever sees variables prefixed with NEXT\_PUBLIC\_. Bolt calls its server-side code server functions or edge functions. [Source: v0 docs, Security↗](https://v0.app/docs/security) Why not hand-code it ## Why does hand-coding email, SMS and WhatsApp take so long? AI builders write the code in seconds. The slow part is everything around it: providers, verification, policies and deployment quirks. 1. 01 ### Email: SMTP is awkward on serverless hosts Vercel blocks outgoing SMTP on port 25 and recommends an email API for most cases, and Supabase Edge Functions refuse ports 25 and 587 altogether. An email API then asks for a verified domain and DNS records before it delivers to anyone but you. 2. 02 ### SMS: numbers, registration, per-segment fees A provider like Twilio rents you a number and bills each segment, $0.0083 in the US plus carrier fees. US traffic from a regular long code needs A2P 10DLC registration, starting with a $4.50 brand fee and vetting. 3. 03 ### WhatsApp: templates and limits Meta's official Cloud API requires an approved template for anything sent outside the 24-hour customer service window, reviewed within 24 hours, priced per template message, with new accounts capped at 250 unique recipients per 24 hours. 4. 04 ### More code for the AI to get wrong Three SDKs and three webhook formats mean more files, more keys and more places where a generated snippet leaks a secret or swallows an error. One endpoint keeps the diff small enough to review. Side by side ## Which messaging stack fits a Bolt.new or v0 app? What each common option needs before your app can message a real user. __Which messaging stack fits a Bolt.new or v0 app?__ | [Nodemailer + SMTP](https://vercel.com/kb/guide/serverless-functions-and-smtp)DIY email | [Resend](https://resend.com/pricing)Email API | [Twilio](https://www.twilio.com/en-us/sms/pricing/us)SMS and WhatsApp API | Unlimited MessagingEmail, SMS and WhatsApp API | | | --------------------------------------------------------------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------- | ---------------------------------------------- | ----------------------------------------------------- | | Channels | Email | Email | SMS and WhatsApp | Email, WhatsApp and SMS in one request | | Cost to test | Free with your own mailbox | Free: 3,000 emails a month, 100 a day | Trial credit, then per message | Free plan, no per-message fee, footer line | | Works in serverless functions | Depends on the host's port rules | Yes, HTTPS | Yes, HTTPS | Yes, HTTPS | | Setup before real users | SMTP credentials | Verified domain and DNS | Number, 10DLC (US), Meta setup for WhatsApp | Link mailbox, scan a QR code, install the Android app | | Inbound replies | Build your own IMAP polling | Delivery event webhooks | Webhooks | Inbox on every plan, webhooks on paid plans | | Scale | Your mailbox's limits | Built for volume | Built for volume | Human pace, no bulk; unofficial WhatsApp | Prices and limits from each vendor's own page, checked on 9 November 2026. Step by step ## From zero to a first message in five steps 1. 01 ### Create a free account Sign up at app.unlimitedmessaging.app with Google, GitHub or your email address. No credit card; the Free plan is permanent. 2. 02 ### Connect your channels Add your mailbox over IMAP/SMTP, scan a QR code to link WhatsApp, and install the Android app on a phone with a SIM for SMS. Start with one if you like. 3. 03 ### Create an API key Open the API section of the dashboard and create a key. Copy it once. 4. 04 ### Add UM\_API\_KEY on the server side v0: Project menu, Settings, Environment Variables, with Development ticked so the preview sees it. Bolt: the Secrets panel (database icon) for server functions, or the gear menu on a Supabase project. 5. 05 ### Paste the prompt The builder writes the route and the call. Test on your own number and inbox before any real user. Copy, paste ## What prompt do you paste into Bolt.new or v0? Paste this into the chat. It asks for a server-side route, the key from the environment and an order confirmation. Swap in your own trigger. Prompt for Bolt.new or v0Prompt ``` Add messaging to this app with Unlimited Messaging (REST API, docs: https://docs.unlimitedmessaging.app). 1. Create a server-side route: in Next.js, app/api/notify/route.ts (or a server action); in a Vite app on Bolt, a server function. Never call the API from client components. 2. Read the key from the environment variable UM_API_KEY. Do not prefix it with NEXT_PUBLIC_ or VITE_, do not hardcode it, and tell me where to add it (v0: Settings > Environment Variables; Bolt: Secrets). 3. Send POST https://api.unlimitedmessaging.app/message with "Authorization: Bearer " and the JSON body { "to": { "phone": "", "email": "" }, "subject": "...", "text": "...", "channels": [{ "channel": "EMAIL" }, { "channel": "WHATSAPP" }, { "channel": "SMS" }] }. 4. Only message the signed-in user, with their contact details read on the server. Return the API status and body so errors are visible. 5. Trigger it after checkout with an order confirmation, and ask me for my own number and email for a first test. ``` The endpoint is plain HTTPS: the same prompt fits Lovable, Cursor or Claude Code with a different first step. POST /api/notifyNext.js ``` // app/api/notify/route.ts export async function POST(req: Request) { const { phone, email, name } = await req.json(); const res = await fetch('https://api.unlimitedmessaging.app/message', { method: 'POST', headers: { Authorization: `Bearer ${process.env.UM_API_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ to: { phone, email }, subject: 'Your order is confirmed', text: `Thanks ${name}, your order is on its way.`, channels: [{ channel: 'EMAIL' }, { channel: 'WHATSAPP' }, { channel: 'SMS' }], }), }); return Response.json(await res.json(), { status: res.status }); } ``` The route handler the builder should produce. In production, take the phone and email from your database for the signed-in user, not from the request body. Remove channels you have not connected. @unlimited-messaging/sdkTypeScript ``` import { UnlimitedMessagingApiClient } from '@unlimited-messaging/sdk'; const um = new UnlimitedMessagingApiClient({ token: process.env.UM_API_KEY! }); // Server-side only: a route handler, a server action or a server function await um.messages.messageSend({ recipient: '+33612345678', text: 'Your code is 291847, valid 5 minutes.', }); ``` The typed SDK (npm i @unlimited-messaging/sdk) for single-channel sends from server code. For several channels in one call, the REST body on the left is the reference. Safety ## Where should the API key live in Bolt.new and v0? In server-side environment variables, read only by server code. Both tools document the same rule. 1. 01 ### v0: no NEXT\_PUBLIC\_ prefix v0's security docs state that only variables prefixed with NEXT\_PUBLIC\_ reach the browser, and that the others stay on the server. Name it UM\_API\_KEY and read it in a route handler or server action. 2. 02 ### v0: tick Development for the preview Variables are encrypted and stored on Vercel. The v0 preview only sees variables available to the Development environment, so add the key there too while you build. 3. 03 ### Bolt: Secrets, used by server functions Bolt's docs say secrets only work with server functions, which run on Bolt's servers rather than in the visitor's browser. On a Supabase-backed project, open Secrets from the gear menu. 4. 04 ### Never a VITE\_ variable In a Vite app, anything prefixed VITE\_ is compiled into the JavaScript the browser downloads. A messaging key there lets anyone send from your number and mailbox. 5. 05 ### No open relay A public route that sends any text to any number is a spam gateway with your name on it. Require a session, look the recipient up on the server and limit sends per user. Replies ## How do you receive replies in a Bolt.new or v0 app? Every plan shows replies in the Unlimited Messaging inbox: email threads, WhatsApp chats and SMS received by the Android app. Pushing them to your own app takes webhooks, included in the paid plans: Medium at €19 a month and Max at €29 a month. Ask the builder for a second route, for example app/api/um-webhook/route.ts, register its public URL on the Webhooks page of the dashboard, and subscribe to message.received and message.status. Read the raw body with await req.text() before parsing it, because the signature covers the exact bytes. Deliveries follow the Standard Webhooks spec, signed with HMAC-SHA256 in the webhook-signature header. Reply 2xx within 10 seconds, then do the work. Failed deliveries are retried for a little more than 3 days, so deduplicate on eventId. message.receivedJSON ``` { "type": "message.received", "eventId": "whd_...", "occurredAt": "2026-11-09T10:00:01.000Z", "data": { "channel": "WHATSAPP", "message": { "text": "Yes, see you Monday!" } } } ``` A message.received event, shortened. data.message holds the sender, the text and, for email, the subject and attachments. verify-webhook.tsTypeScript ``` import { createHmac } from 'node:crypto'; import { Buffer } from 'node:buffer'; // Standard Webhooks signature check, before trusting the body. export function isValid(rawBody: string, h: Headers, secret: string) { const id = h.get('webhook-id'); const ts = h.get('webhook-timestamp'); const sig = h.get('webhook-signature') ?? ''; if (!id || !ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64'); const expected = createHmac('sha256', key) .update(`${id}.${ts}.${rawBody}`) .digest('base64'); return sig.split(' ').some((s) => s === `v1,${expected}`); } ``` Signature check for a Next.js route handler or a Bolt server function. Keep the whsec\_ secret in a second server variable, UM\_WEBHOOK\_SECRET. Limits ## What are the limits, honestly? Unlimited Messaging sends from personal accounts, at a human pace. Plan for that before you launch. 1. 01 ### WhatsApp is unofficial Your number is linked as a device, like WhatsApp Web, outside Meta's Business Platform. Unsolicited messages get numbers banned. If you need official WhatsApp at scale, use Meta's Cloud API. 2. 02 ### Email follows your mailbox A personal Gmail account sends up to 500 emails a day. For newsletters or large volumes, an email service provider with a sending domain is the right tool. 3. 03 ### SMS at Android's pace Android asks for confirmation beyond 30 SMS in 30 minutes, so the app spaces sends out. Texts count against your carrier plan, and the sending phone must run Android. 4. 04 ### Free plan trade-offs Messages on Free end with "Sent with UnlimitedMessaging.app". Media, voice messages and webhooks come with Medium and Max, which also drop the footer. Key takeaway ### One server route, one variable, three channels. Keep UM\_API\_KEY in server-side variables, call POST /message from a route handler or server function, and your Bolt.new or v0 app reaches email, WhatsApp and SMS in one request. Free to start; paid only for webhooks, media or no footer. FAQ ## Questions about messaging from Bolt.new and v0 Yes, from server code. Ask Bolt for a server function or API route that calls an email API with a key stored in Secrets. With Unlimited Messaging, that call sends from your own mailbox on the free plan, and can add WhatsApp and SMS. Add UM\_API\_KEY in the project's environment variables, have v0 write a route handler that calls POST /message with the SMS channel, and install the free Android app on a phone with a SIM. The text leaves from that phone's number. Link your WhatsApp number with a QR code in the Unlimited Messaging dashboard, then send with the WHATSAPP channel from a server function. There are no Meta templates to approve, but it is an unofficial link: message only people who expect it. Yes. npm i @unlimited-messaging/sdk gives a typed client, UnlimitedMessagingApiClient, with messages.messageSend. Use it in server code only. The REST body in this guide is the reference for multi-channel sends. No. There is no partnership and no native integration. It is a standard REST API that any server code generated by Bolt.new or v0 can call. Yes, as long as UM\_API\_KEY is set in that host's server-side environment variables. The call is plain HTTPS, so no SMTP port has to be open. Sources ## Sources & references To check the information in this article for yourself: 1. [01Security (only NEXT\_PUBLIC\_ variables reach the browser)↗v0 documentation](https://v0.app/docs/security) 2. [02External APIs (environment variables encrypted and stored on Vercel)↗v0 documentation](https://v0.app/docs/external-apis) 3. [03Environment variables↗Vercel documentation](https://vercel.com/docs/environment-variables) 4. [04Can I use SMTP with Vercel? (port 25 blocked)↗Vercel Knowledge Base](https://vercel.com/kb/guide/serverless-functions-and-smtp) 5. [05Secrets (only work with server functions)↗Bolt support](https://support.bolt.new/cloud/database/secrets) 6. [06Server functions↗Bolt support](https://support.bolt.new/cloud/database/server-functions) 7. [07Supabase integration↗Bolt support](https://support.bolt.new/integrations/supabase) 8. [08Route handlers↗Next.js documentation](https://nextjs.org/docs/app/building-your-application/routing/route-handlers) 9. [09Edge Function limits (ports 25 and 587 not allowed)↗Supabase documentation](https://supabase.com/docs/guides/functions/limits) 10. [10Resend pricing (Free: 3,000 emails a month, 100 a day)↗Resend](https://resend.com/pricing) 11. [11SMS pricing in the United States ($0.0083 per segment)↗Twilio](https://www.twilio.com/en-us/sms/pricing/us) 12. [12A2P 10DLC Brand Registration ($4.50 brand fee)↗Twilio](https://www.twilio.com/docs/trust-hub/registrations/a2p-10dlc-brand) 13. [13Message template review (decision within 24 hours)↗Meta for Developers](https://developers.facebook.com/documentation/business-messaging/whatsapp/templates/template-review) 14. [14WhatsApp messaging limits (250 unique recipients per 24 hours to start)↗Meta for Developers](https://developers.facebook.com/documentation/business-messaging/whatsapp/messaging-limits) 15. [15Limits for sending and getting mail (500 emails a day)↗Gmail Help](https://support.google.com/mail/answer/22839) 16. [16SmsUsageMonitor (30 SMS in 30 minutes threshold)↗Android Open Source Project](https://android.googlesource.com/platform/frameworks/opt/telephony/+/refs/heads/main/src/java/com/android/internal/telephony/SmsUsageMonitor.java) 17. [17Standard Webhooks specification↗Standard Webhooks](https://www.standardwebhooks.com) ![Ilian, senior software engineer](https://ilianazz.com/images/iliazz.png) Written by [Ilian](https://unlimitedmessaging.app/authors/ilian) · Senior Software Engineer A senior software engineer, he founds and runs several tech companies. He builds products around messaging APIs, automation and AI integration, and shares here what he learns while building. [View LinkedIn profile↗](https://www.linkedin.com/in/ilianAzz/)Updated November 9, 2026 ![](https://unlimitedmessaging.app/assets/logos/whatsapp.svg)![](https://unlimitedmessaging.app/assets/logos/email.svg)![](https://unlimitedmessaging.app/assets/logos/sms.svg) ## Let your app talk to users today. Create a free account, connect a mailbox, a number or a phone, and paste the prompt into Bolt.new or v0. [Get a free API key→](https://app.unlimitedmessaging.app) Similar articles * [![](https://unlimitedmessaging.app/_next/image?url=%2Fassets%2Farticles%2Fcovers%2Ftypescript-sdk-en.png&w=3840&q=75)Send WhatsApp from Node.js with a fully typed SDKFully typed npm package for Node.js, Next.js, and any JS environment.](https://unlimitedmessaging.app/articles/typescript-sdk) * [![](https://unlimitedmessaging.app/_next/image?url=%2Fassets%2Farticles%2Fcovers%2Femail-whatsapp-single-api-request-en.png&w=3840&q=75)One API request, two channels: email and WhatsApp at onceSend the same message by WhatsApp and email in one call, from your own number and mailbox, free on every plan.](https://unlimitedmessaging.app/articles/email-whatsapp-single-api-request) * [![](https://unlimitedmessaging.app/_next/image?url=%2Fassets%2Farticles%2Fcovers%2Fnotifications-en.png&w=3840&q=75)Order confirmations on WhatsApp: the 2026 setup guideSend order confirmations, alerts, and receipts via WhatsApp.](https://unlimitedmessaging.app/articles/notifications)