Wrap pindo-sms in an Angular injectable service and use it across your application.
In Angular applications, wrap PindoSMS in an @Injectable service. This lets you inject the SMS client anywhere in your app via Angular’s dependency injection system.
Angular’s build system supports src/environments/environment.ts for per-environment configuration. Store your Pindo token there rather than hard-coding it:
Angular environment files are bundled into the client-side JavaScript and are visible in the browser. Use them only for tokens that are safe to expose publicly, or restrict SMS sending to a server-side proxy (such as an Angular Universal API route or a separate backend).
If your application uses Angular Universal, you can move SMS sending entirely to the server to keep your token out of the browser bundle.
1
Create a server-side API endpoint
Add an Express route in server.ts (the Universal server entry point) that calls PindoSMS directly:
server.ts (excerpt)
import { PindoSMS, SMSPayload } from 'pindo-sms';const pindo = new PindoSMS(process.env['PINDO_API_TOKEN']!);server.post('/api/send-sms', async (req, res) => { const { to, text, sender } = req.body as SMSPayload; try { const response = await pindo.sendSMS({ to, text, sender }); res.json(response); } catch (error) { res.status(500).json({ message: 'Failed to send SMS' }); }});
2
Call the endpoint from your Angular service
Replace the direct PindoSMS call in PindoSMSService with an HttpClient request to your own endpoint:
src/app/pindo-sms.service.ts
import { Injectable } from '@angular/core';import { HttpClient } from '@angular/common/http';import { lastValueFrom } from 'rxjs';@Injectable({ providedIn: 'root' })export class PindoSMSService { constructor(private http: HttpClient) {} sendSMS(to: string, text: string, sender: string): Promise<any> { return lastValueFrom( this.http.post('/api/send-sms', { to, text, sender }), ); }}
Store the token as an environment variable (PINDO_API_TOKEN) in the Node.js process running Angular Universal rather than in environment.ts. The token never reaches the browser.