Recently shipped.

Keyword configuration is now open to every workspace, and on the public API alongside it.

Bird has always recognised and honoured a STOP on your numbers with no setup on your side, and that has not changed. What is new is that you can see exactly which keywords it recognises where, and make the replies say your name instead of ours.

Getting started

• Opt-outs and keywords

What's available

• See what applies: list the rules for a country, or for one of your numbers in the order they are applied, including what a sender messaging from elsewhere gets.
• Replace a reply: override Bird's opt-out, opt-in, or help wording for a country. Your rule keeps Bird's keywords unless you add more, including keywords Bird adds later, so your compliance answer does not go stale.
• Campaign keywords: add custom keywords of your own with the reply you write.
• Answer from your own system: switch Bird's auto-reply off for a rule while the opt-out itself keeps being honoured.
• Everywhere you build: the dashboard, the API, the Go, TypeScript, Python, and PHP SDKs, bird sms keyword-rules on the CLI, and the matching MCP tools.

What an opt-out or opt-in keyword does is fixed and cannot be reassigned. Coverage is per country: listing the rules for a country shows what is recognised there, and where nothing is, no keyword is matched and no opt-out is recorded, so you are responsible for honouring opt-outs there yourself.

Two parts of SMS that were dashboard-only are now on the public API, with typed SDK methods, bird CLI commands, and MCP tools for each.

Getting started

• SMS stats API
• Opt-outs and keywords

What's available

• Statistics: the aggregate summary, the daily and hourly series, and breakdowns by destination country, carrier, originator, category, status, and failure reason, plus counts of what your numbers received, by country, operator, and number. The same aggregation the Metrics dashboard reads.
• Suppressions: list who your senders may not message and why, check one subscriber before sending to them, and add or end a suppression of your own. A send to a suppressed pair is refused with SMSRecipientSuppressed rather than going out.
• Message timeline: a message's lifecycle events are now a public read, alongside the message itself.
• Everywhere you build: the API, the Go, TypeScript, Python, and PHP SDKs, bird sms stats, bird sms suppressions, and bird sms list-events on the CLI, and the matching MCP tools.

You can now send SIP over TCP to port 5060, the same port UDP already uses. TCP used to have a port of its own, 5062, which meant every TCP setup had to be told about it explicitly.

Nothing breaks if you are already on 5062: it still accepts TCP calls, so equipment pointed at it keeps working and needs no change. Use 5060 for anything you set up from now on.

TLS is unchanged on 5061.

SMS had one scope. A key that could send a message could also delete a suppression, change a sender, edit the destination allowlist, and file a 10DLC registration. There was no way to hand someone SMS configuration without also handing them the ability to send, and no way to give support read-only access without write.

That splits today, the way Email and WhatsApp already did. sms keeps sending and the message log. Everything that configures the channel moves to a new sms_management scope.

What moves

sms_management now covers senders and their country registrations, 10DLC brands and campaigns, toll-free verification, suppressions, keyword replies, the destination allowlist, and templates.

sms keeps POST /v1/sms/messages, the batch send, the message log and its events, and SMS statistics.

Both scopes take read and write, and every built-in role holds the same level on both, so nothing changes for people in the dashboard. Admins and developers manage SMS as before; analysts still read it.

If you call these from an API key

Four operations change what they require, and existing keys are affected. GET /v1/sms/templates, GET /v1/sms/templates/{template_ref}, GET /v1/sms/destinations and PUT /v1/sms/destinations now need sms_management and return 403 for a key holding only sms. The same applies to bird sms templates and bird sms destinations on the CLI, and to the matching MCP tools.

A key's scopes are fixed when it is issued and cannot be changed, so the fix is a new key. Create one with both sms and sms_management from Developers → API keys, swap it in, and revoke the old one. On the CLI, bird login again: a fresh token carries sms_management:read.

The other management endpoints are reachable only from the dashboard, which already carries the new scope.

Granting less

The point of the split is the key you can now mint. A service that only sends holds sms:write and cannot touch a suppression. A support tool that reads senders and registrations holds sms_management:read and can send nothing. Grant the narrowest pair that works.

Verify now delivers one-time passcodes over Telegram, alongside email, SMS, and WhatsApp. The channel is available in every country and sits after WhatsApp and SMS but before email, so no verification changes the channel it starts on. Where a recipient has both a phone number and an email address, Telegram is now tried before the email fallback. If you have pinned a channel order for a country, Telegram joins the end of that pin instead, until you save a new order placing it where you want it.

Codes arrive from Telegram's own verified notification account. There is no Bird sender and no sender of your own to configure, which is a property of the Telegram Gateway rather than something still to come. A number is checked for whether it can receive a Telegram message before one is sent, and where it cannot, the verification moves to the next channel without a message going out.

Using it

Nothing is required to turn it on. To reach Telegram earlier for a given country, reorder that country's channels in country configuration, or name the order per request with options.channels on POST /v1/verify/verifications. telegram is a valid channel name everywhere a channel name is accepted.

One thing to check if you call the API directly

A per-country channel order must name every channel available in that country. Telegram has now joined that set, so orders you saved before this release keep working, but re-submitting one is rejected with a 422 until you add telegram to it. Reading the country's current channels and submitting them back is enough. The dashboard handles this for you.