---
title: "mTLS for API requests and webhook deliveries"
description: "Require a client certificate on API requests through a dedicated mTLS endpoint, and have Bird present a client certificate on webhook deliveries."
canonical: "https://bird.com/changelog/docs-update-2026-10-30-96b1ca3"
---

Bird introduces mTLS, available on request, for both directions of a connection.

For API requests, add your certificate authority's public certificate in **Workspace settings → mTLS** (or [`POST /v1/workspace/mtls-certificate-authorities`](/docs/api/reference/create-workspace-mtls-certificate-authority)), then send requests to the new `mtls.<region>.platform.bird.com` endpoint with a client certificate. Run in `evaluating` mode while you move traffic over, then switch to `enforced` so the standard endpoint stops accepting API key and service account requests entirely.

For webhook deliveries, Bird generates a key pair and a certificate signing request under **Webhooks → mTLS**, your certificate authority signs it, and Bird presents the signed certificate whenever your receiver asks for one during the TLS handshake. [`POST /v1/webhooks/{webhook_id}/test`](/docs/api/reference/test-webhook) now returns a `client_certificate` field (`presented`, `not_requested`, or `rejected`) so you can confirm your receiver is checking it correctly before enforcing.

Both directions support certificate revocation checks against a certificate's CRL, and a required subject alternative name for API requests when your certificate authority also issues to other parties. See the [mTLS guide](/docs/guides/mtls) for setup, rotation, and troubleshooting.

Also in this release:

- **WhatsApp templates can set a delivery time-to-live.** `message_send_ttl_seconds` on a template language controls how long WhatsApp keeps trying before dropping an undelivered message, from 30 seconds up to 30 days depending on category. See [Upsert WhatsApp template language](/docs/api/reference/upsert-whatsapp-template-language).
- **Workspace quotas report their type.** [`GET /v1/workspace/quotas`](/docs/api/reference/list-workspace-quotas) now returns `type` (`integer` or `boolean`) and `label` alongside each quota, so a feature-switch quota no longer reports a misleading `unit`.
- **Callback signing secrets now cover voice sequence webhooks.** Rotating your workspace's signing secret at [`POST /v1/webhook-callbacks/rotate-signing-secret`](/docs/api/reference/rotate-webhook-callback-signing-secret) re-signs both SMS callback URLs and voice sequence webhook requests, which now share one secret.

## Related resources

- [Webhooks & events](/docs/guides/webhooks) (docs)
- [Webhooks done right: reliable delivery events](/learn/basics/webhooks-done-right-reliable-delivery-events) (video)
- [How do I verify a webhook signature?](/explained/platform/how-do-i-verify-a-webhook-signature) (answer)
- [Operate messaging reliably](/learn/paths/reliability) (course)

[Get an implementation brief](/learn/workspace?topic=webhooks)