Verify binds SMS passcodes to your Android app for tap-free autofill

Set an Android app hash on the Verify Configure page, or pass options.android_app_hash on create verification, and the SMS shortens to just the code and your app's 11-character hash on its own line, within Google's 140-byte SMS Retriever limit. Your Android app reads the code automatically, with no SMS permission request and no tap from the user. Leave it unset and SMS passcodes behave as before, with the website-binding line browsers read for autofill.

A request can override the workspace default with its own hash, for example to point a debug build at its own signing certificate. See Verification settings for how to compute the hash and troubleshoot it.

Also in this release:

• Email mailboxes can set up forwarding after creation. POST /v1/email/mailboxes/{mailbox_id}/forwarding-address, or Mailbox settings → Set up forwarding in the dashboard, gives an existing own-domain mailbox a forwarding address on Bird's receiving domain without recreating it. Until now, a mailbox only got one automatically, and only if its domain wasn't already set up for receiving when it was created.
• Workspace-level rate limits. An organization with several workspaces can give one workspace its own request-rate ceiling on top of the limit it shares with the rest of the organization, from the dashboard's workspace Rate limits page, the new GET /v1/workspace/rate-limits endpoint, or bird organization workspaces rate-limits. A 429 now reports which policy, and which scope, organization or workspace, refused the request.
• Apple Messages for Business sends are simpler. text, rich_link, and interactive are now top-level fields on send message instead of nested under a content object, a reply to an interactive message comes back as interactive_reply, and a new skip_typing flag skips the typing indicator Bird shows before a reply when you already sent one yourself through the typing-indicator endpoint.