How to Integrate Bolt.new with Signal

Before spending time trying to integrate Signal directly, it is important to understand why it cannot be done and choose the right alternative for your use case. Signal Foundation has never offered a public API. Their position is unambiguous: 'We're a nonprofit. We're not here to build an ecosystem of integrations.' Signal's end-to-end encryption is designed so that only the sender and recipient devices hold the keys. An API would require routing messages through a third-party server, which is architecturally incompatible with this model. signal-cli is a community project that uses Signal's protocol without authorization. Using it violates Signal's Terms of Service, which explicitly prohibit 'using Signal for any commercial purpose without our express consent' and 'using any automated system to access Signal.' Signal has rate-limited and blocked signal-cli registrations in the past. Additionally, signal-cli requires a Linux server running as a persistent daemon, which is incompatible with both Bolt's WebContainer and serverless API routes. For sending messages to users outside your app: use Twilio. Twilio supports SMS, WhatsApp (encrypted like Signal, widely adopted), and voice. It has an official REST API with an official Node.js SDK, production-grade reliability, and straightforward pricing. WhatsApp specifically offers end-to-end encryption and is used by many of the same privacy-conscious users who prefer Signal. For encrypted messaging between users inside your app: use Supabase Realtime for message transport and the Web Crypto API (window.crypto.subtle) for encryption. This approach gives you genuine end-to-end encryption — messages are encrypted in the sender's browser and cannot be read by your server. This is the architectural equivalent of Signal's security model, built with standard browser APIs.

If your goal is to send messages to users on their phones, Twilio is the correct tool. Create a Twilio account at twilio.com — the free trial gives you $15 credit, enough for hundreds of test messages. Note your Account SID and Auth Token from the Twilio console dashboard. For WhatsApp specifically (the privacy-focused alternative most similar to Signal's demographic), you need to request access to the Twilio WhatsApp sandbox for development testing, or submit your app for WhatsApp Business API approval for production use. For SMS (simpler to set up), buy a Twilio phone number from the Twilio console under 'Phone Numbers → Manage → Buy a number'. Install the Twilio Node.js SDK (@twilio/twilio in npm). Create a Next.js API route that accepts a recipient number and message body, initializes the Twilio client with your credentials from environment variables, and sends the message. The Twilio SDK communicates over HTTPS and works perfectly inside Bolt's WebContainer — this is a standard outbound API call with no TCP socket requirement. Store TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN in your .env file, never in client-side code. Twilio credentials with access to send messages are sensitive — a leaked Auth Token allows anyone to send messages and incur charges on your account. Always call the Twilio SDK from API routes only.

1// app/api/messaging/send/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import twilio from 'twilio';
4
5export async function POST(request: NextRequest) {
6  const { to, message } = await request.json();
7
8  if (!to || !message) {
9    return NextResponse.json(
10      { error: 'Both to (phone number) and message are required' },
11      { status: 400 }
12    );
13  }
14
15  const accountSid = process.env.TWILIO_ACCOUNT_SID;
16  const authToken = process.env.TWILIO_AUTH_TOKEN;
17  const fromNumber = process.env.TWILIO_PHONE_NUMBER;
18
19  if (!accountSid || !authToken || !fromNumber) {
20    return NextResponse.json(
21      { error: 'Twilio credentials not configured' },
22      { status: 500 }
23    );
24  }
25
26  try {
27    const client = twilio(accountSid, authToken);
28    const msg = await client.messages.create({
29      body: message,
30      from: fromNumber,
31      to: to,
32    });
33
34    return NextResponse.json({
35      success: true,
36      messageSid: msg.sid,
37      status: msg.status,
38    });
39  } catch (err: any) {
40    return NextResponse.json(
41      { error: err.message, code: err.code },
42      { status: 400 }
43    );
44  }
45}

For in-app private messaging between your users — with the same end-to-end encryption model that Signal uses — combine Supabase Realtime for message delivery with the Web Crypto API for encryption. This is the architecturally correct way to build a Signal-quality messaging system without relying on Signal's network. The encryption scheme uses Elliptic Curve Diffie-Hellman (ECDH) key exchange. Each user generates an ECDH key pair in their browser using window.crypto.subtle.generateKey(). The public key is shared openly (stored in your users table in Supabase). When two users start a conversation, each derives a shared secret from their own private key and the other person's public key — this shared secret is mathematically identical on both sides but was never transmitted over the network. Messages are encrypted with AES-GCM (a symmetric cipher) using the shared secret as the encryption key. The encrypted ciphertext is what gets stored in Supabase and transmitted via Supabase Realtime. Only the two participants who derived the same shared secret can decrypt it — not your server, not Supabase, and not anyone who intercepts the network traffic. This is exactly how Signal's protocol works at a high level. Bolt's WebContainer fully supports the Web Crypto API (window.crypto.subtle) — it is a standard browser API, not a Node.js module. This encryption approach requires no external dependencies and no native modules.

1// src/lib/crypto.ts
2// End-to-end encryption using Web Crypto API (built into browsers — no npm needed)
3
4export async function generateKeyPair(): Promise<CryptoKeyPair> {
5  return window.crypto.subtle.generateKey(
6    { name: 'ECDH', namedCurve: 'P-256' },
7    true, // extractable (so we can export/import)
8    ['deriveKey']
9  );
10}
11
12export async function exportPublicKey(publicKey: CryptoKey): Promise<string> {
13  const exported = await window.crypto.subtle.exportKey('spki', publicKey);
14  return btoa(String.fromCharCode(...new Uint8Array(exported)));
15}
16
17export async function deriveSharedSecret(
18  myPrivateKey: CryptoKey,
19  theirPublicKeyBase64: string
20): Promise<CryptoKey> {
21  const keyBytes = Uint8Array.from(atob(theirPublicKeyBase64), c => c.charCodeAt(0));
22  const theirPublicKey = await window.crypto.subtle.importKey(
23    'spki',
24    keyBytes,
25    { name: 'ECDH', namedCurve: 'P-256' },
26    false,
27    []
28  );
29
30  return window.crypto.subtle.deriveKey(
31    { name: 'ECDH', public: theirPublicKey },
32    myPrivateKey,
33    { name: 'AES-GCM', length: 256 },
34    false,
35    ['encrypt', 'decrypt']
36  );
37}
38
39export async function encryptMessage(
40  sharedSecret: CryptoKey,
41  plaintext: string
42): Promise<string> {
43  const iv = window.crypto.getRandomValues(new Uint8Array(12));
44  const encoded = new TextEncoder().encode(plaintext);
45  const ciphertext = await window.crypto.subtle.encrypt(
46    { name: 'AES-GCM', iv },
47    sharedSecret,
48    encoded
49  );
50  const combined = new Uint8Array(iv.length + ciphertext.byteLength);
51  combined.set(iv, 0);
52  combined.set(new Uint8Array(ciphertext), iv.length);
53  return btoa(String.fromCharCode(...combined));
54}
55
56export async function decryptMessage(
57  sharedSecret: CryptoKey,
58  encryptedBase64: string
59): Promise<string> {
60  const combined = Uint8Array.from(atob(encryptedBase64), c => c.charCodeAt(0));
61  const iv = combined.slice(0, 12);
62  const ciphertext = combined.slice(12);
63  const decrypted = await window.crypto.subtle.decrypt(
64    { name: 'AES-GCM', iv },
65    sharedSecret,
66    ciphertext
67  );
68  return new TextDecoder().decode(decrypted);
69}

With the crypto utilities in place, connect them to Supabase Realtime for live message delivery. Create a conversations table and a messages table in Supabase. The messages table stores conversation_id, sender_id, and encrypted_content (the base64-encoded ciphertext from encryptMessage). Plaintext is never stored. When a user opens a conversation, subscribe to new messages using Supabase's realtime channel. When a new message arrives, decrypt it client-side using the pre-derived shared secret for that conversation. When the user sends a message, encrypt it client-side before inserting it into Supabase. This architecture guarantees that if your Supabase database is breached or subpoenaed, the attacker only gets ciphertext. They cannot decrypt the messages without the recipient's private key, which only exists in the recipient's browser. This is functionally equivalent to Signal's security guarantees within the scope of your app's user base. During Bolt development in the WebContainer preview, Supabase Realtime (WebSocket-based) works fully — you can test the full encrypted chat flow including real-time message delivery without deploying first.

1// Supabase schema for encrypted messages
2// Run this in Supabase SQL editor
3
4CREATE TABLE conversations (
5  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
6  participant_a UUID REFERENCES auth.users(id),
7  participant_b UUID REFERENCES auth.users(id),
8  created_at TIMESTAMPTZ DEFAULT now()
9);
10
11CREATE TABLE messages (
12  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
13  conversation_id UUID REFERENCES conversations(id) ON DELETE CASCADE,
14  sender_id UUID REFERENCES auth.users(id),
15  -- Only ciphertext is stored — server never sees plaintext
16  encrypted_content TEXT NOT NULL,
17  created_at TIMESTAMPTZ DEFAULT now()
18);
19
20-- Store users' public keys for ECDH key exchange
21ALTER TABLE auth.users ADD COLUMN IF NOT EXISTS
22  public_key TEXT; -- base64-encoded ECDH public key
23
24-- RLS: users can only read messages in their conversations
25ALTER TABLE messages ENABLE ROW LEVEL SECURITY;
26CREATE POLICY "Users see their conversation messages"
27  ON messages FOR SELECT
28  USING (
29    conversation_id IN (
30      SELECT id FROM conversations
31      WHERE participant_a = auth.uid() OR participant_b = auth.uid()
32    )
33  );
34
35-- Enable Realtime on messages table
36ALTER PUBLICATION supabase_realtime ADD TABLE messages;

For the Twilio messaging path, deploy your app to Netlify or Bolt Cloud before setting up incoming message handling. Twilio can POST incoming messages to a webhook URL on your server — this allows you to build two-way messaging where users can reply and your app processes their responses. After deploying, go to your Twilio console → Phone Numbers → your number → Messaging → A message comes in. Set the webhook URL to https://your-app.netlify.app/api/messaging/incoming. Create this API route that parses Twilio's webhook payload and processes the incoming message. Important: Twilio webhooks require a publicly accessible server URL. During development in Bolt's WebContainer, outbound Twilio calls work perfectly, but incoming webhooks from Twilio cannot reach the WebContainer. Deploy first, then configure and test webhook-dependent features on your deployed site. For the in-app encrypted chat path (Supabase Realtime), no additional deployment steps are required — Supabase Realtime uses WebSockets initiated from the client, not incoming webhooks. The encrypted chat feature works identically in the Bolt preview and in production.

1// app/api/messaging/incoming/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import twilio from 'twilio';
4
5export async function POST(request: NextRequest) {
6  // Twilio sends URL-encoded form data, not JSON
7  const formData = await request.formData();
8  const from = formData.get('From') as string;
9  const body = formData.get('Body') as string;
10  const messageSid = formData.get('MessageSid') as string;
11
12  // Validate webhook signature (requires deployed URL)
13  const signature = request.headers.get('x-twilio-signature') ?? '';
14  const authToken = process.env.TWILIO_AUTH_TOKEN!;
15  const webhookUrl = `${process.env.NEXT_PUBLIC_APP_URL}/api/messaging/incoming`;
16
17  const isValid = twilio.validateRequest(
18    authToken,
19    signature,
20    webhookUrl,
21    Object.fromEntries(formData.entries()) as Record<string, string>
22  );
23
24  if (!isValid) {
25    return new NextResponse('Forbidden', { status: 403 });
26  }
27
28  // Process the incoming message (save to DB, trigger notifications, etc.)
29  console.log(`Incoming message from ${from}: ${body}`);
30
31  // Send TwiML response (XML for auto-reply)
32  const twiml = `<?xml version="1.0" encoding="UTF-8"?>
33<Response>
34  <Message>Thanks for your message. We'll get back to you soon.</Message>
35</Response>`;
36
37  return new NextResponse(twiml, {
38    status: 200,
39    headers: { 'Content-Type': 'text/xml' },
40  });
41}