Récemment livré.

Bird introduces mTLS, available on request, for both directions of a connection.

For API requests, add your certificate authority's public certificate in Workspace settings → mTLS (or POST /v1/workspace/mtls-certificate-authorities), then send requests to the new mtls.<region>.platform.bird.com endpoint with a client certificate. Run in evaluating mode while you move traffic over, then switch to enforced so the standard endpoint stops accepting API key and service account requests entirely.

For webhook deliveries, Bird generates a key pair and a certificate signing request under Webhooks → mTLS, your certificate authority signs it, and Bird presents the signed certificate whenever your receiver asks for one during the TLS handshake. POST /v1/webhooks/{webhook_id}/test now returns a client_certificate field (presented, not_requested, or rejected) so you can confirm your receiver is checking it correctly before enforcing.

Both directions support certificate revocation checks against a certificate's CRL, and a required subject alternative name for API requests when your certificate authority also issues to other parties. See the mTLS guide for setup, rotation, and troubleshooting.

Also in this release:

• WhatsApp templates can set a delivery time-to-live. message_send_ttl_seconds on a template language controls how long WhatsApp keeps trying before dropping an undelivered message, from 30 seconds up to 30 days depending on category. See Upsert WhatsApp template language.
• Workspace quotas report their type. GET /v1/workspace/quotas now returns type (integer or boolean) and label alongside each quota, so a feature-switch quota no longer reports a misleading unit.
• Callback signing secrets now cover voice sequence webhooks. Rotating your workspace's signing secret at POST /v1/webhook-callbacks/rotate-signing-secret re-signs both SMS callback URLs and voice sequence webhook requests, which now share one secret.

Set an Android app hash on the Verify Configure page, or pass options.android_app_hash on create verification, and the SMS shortens to just the code and your app's 11-character hash on its own line, within Google's 140-byte SMS Retriever limit. Your Android app reads the code automatically, with no SMS permission request and no tap from the user. Leave it unset and SMS passcodes behave as before, with the website-binding line browsers read for autofill.

A request can override the workspace default with its own hash, for example to point a debug build at its own signing certificate. See Verification settings for how to compute the hash and troubleshoot it.

Also in this release:

• Email mailboxes can set up forwarding after creation. POST /v1/email/mailboxes/{mailbox_id}/forwarding-address, or Mailbox settings → Set up forwarding in the dashboard, gives an existing own-domain mailbox a forwarding address on Bird's receiving domain without recreating it. Until now, a mailbox only got one automatically, and only if its domain wasn't already set up for receiving when it was created.
• Workspace-level rate limits. An organization with several workspaces can give one workspace its own request-rate ceiling on top of the limit it shares with the rest of the organization, from the dashboard's workspace Rate limits page, the new GET /v1/workspace/rate-limits endpoint, or bird organization workspaces rate-limits. A 429 now reports which policy, and which scope, organization or workspace, refused the request.
• Apple Messages for Business sends are simpler. text, rich_link, and interactive are now top-level fields on send message instead of nested under a content object, a reply to an interactive message comes back as interactive_reply, and a new skip_typing flag skips the typing indicator Bird shows before a reply when you already sent one yourself through the typing-indicator endpoint.

Organization owners can now set up SCIM provisioning from SCIM provisioning in organization settings. Connect an active SSO connection, create a dedicated SCIM key, and configure your identity provider using the URL shown in Bird.

Assign roles through people or groups in your identity provider. One person can have different roles in different Bird workspaces. Deactivating or deleting a managed user removes their access to that organization, including manually assigned roles. Their Bird account and access to other organizations remain available. Keep an organization owner outside provisioning for recovery access.

Use one directory per organization. Bird provisions users and their roles; groups stay in your identity provider. Manual edits to managed roles can be overwritten by the next SCIM update.

Follow Set up SCIM with Okta or Set up SCIM with Microsoft Entra ID. The SCIM provisioning guide covers role values, key rotation, and pausing provisioning.

You can now set the maximum Meta may charge for each delivered WhatsApp marketing message. Compare estimated cost and reach at different prices, then choose a cap for each template language and add country overrides for the markets you send to.

In the template editor, open Pricing and enable Use maximum price. Enter your cap per 1,000 deliveries in the displayed business-account currency, or select a price on the graph. Save and submit the draft to request the pricing change.

Set up maximum pricing.

Bird is now in the ChatGPT and Codex plugin directories. Install it, sign in to your Bird workspace, and your agent can send email, SMS and WhatsApp, manage domains and numbers, and check delivery.

Try a task:

• "Set up acme.com as a sending domain and tell me which DNS records to add."
• "Send a test email and check whether it was delivered."
• "Why are emails to Outlook bouncing?"
• "Draft replies to everything unanswered in my support inbox."
• "Audit acme.com’s email authentication."