Termux:API app has a command termux-sms-list to list SMS messages on the Termux terminal. However, the wiki says that it is not supported anymore because of Google.
Usage of this API is no longer allowed by Google and we had to disable it to prevent delisting of Termux:API application from the Google Play.
But still, banking apps that use OTP authentication using SMS can still auto-read the incoming SMS and enter the password without user interaction.
So what makes them different API-wise?
Google blocks apps from (mis)using Call Log and/or SMS permissions if they are not the core functionalities of the apps, with some exceptions and alternatives.
SMS (termux-sms-list and termux-sms-send) and Call Log (termux-call-log) are not the main purpose of Termux:API app, thus the developer had to remove the permissions to prevent the app from being removed on the Play Store.
From Play Console Help,
If your app does not require access to Call Log or SMS permissions, you must remove these permissions from your app's manifest. Details on policy compliant alternative implementation are also detailed below.
When should you access these permissions
You should only access Call Log or SMS permissions when your app falls within permitted uses and only to enable your app’s critical core functionality.
Core functionality is defined as the main purpose of the app. This may comprise of a set of core features, which must all be prominently documented and promoted in the app's description. Without the core feature(s), the app is "broken" or rendered unusable.
There are some temporary exceptions that the developer can apply for (detail on the same help page), but in the end, it's up to Google's discretion to allow it or not.
On the other hand, Google also provides an alternative exclusive for reading OTP SMS, called SMS Verification APIs which utilizes Google Play Services. This doesn't require an app to request SMS permission, but the device needs to have Play Services working.
Though, the restriction is mainly limited to the Google Play Store's policy. Apps hosted on alternative markets or self-hosted may ignore this and just use the Android permissions as before without worrying about delisting, though users may feel uncomfortable with such privacy-invasive permissions.
In short, API-wise, the difference is:
Q & A