> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.messageblue.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.messageblue.ai/_mcp/server.

# Settings

Route `/settings`

Find it Left rail → Settings

Who can open it Admins and team members

Settings holds *"Team, webhooks, API credentials, Zapier, and HubSpot CRM for this app."* across five tabs. All five are always present — none is gated on a feature flag.

## Team

**Invite a member** takes an email address and a role:

| Role            | Can do                                                                                 |
| --------------- | -------------------------------------------------------------------------------------- |
| **Team member** | Everything except revoking device access                                               |
| **Admin**       | The same, plus [revoking a device](/analytics#agents-and-devices), and inviting others |

![Settings Team tab with an Invite a member form and a list of current members badged Admin](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/8646fadefc013131a6b5310d54307a04262f9ff1486230f34af9572fe6ee6cab/docs/assets/frontend/settings-team.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=980c85f3e0888d41066a12598b2faa1087511d5b685239c4f9b4fb1285a95ae0&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Current members are listed below, each removable, with their role shown as a badge. Inviting an address is also what lets that person past the [Access Denied](/sign-in#when-you-cannot-get-in) screen — an account that authenticates but was never invited cannot reach the app.

## Webhooks

Where MessageBlue delivers events to *your* server. Two independent URLs:

#### Inbound webhook URL

Incoming iMessages are POSTed here as JSON events.

#### Status webhook URL

Delivery statuses — `sent`, `delivered`, `SMS_FALLBACK`, `failed` — are POSTed here. Set once; there is no per-message callback to register.

![Settings Webhooks tab with inbound and status URL fields, a Save button, the signing secret with a Generate button, and four bullet points describing the contract](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/c0368b015c36f5d780797265360244facd26d2541e954028c11e2acc441b88fd/docs/assets/frontend/settings-webhooks.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=bea43e6d30801ed61e3d0d00dd4cde6334831775177c6bf886bfe06a628626f5&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

The two URLs are saved together with **Save**. The **Signing secret** field sits below them and reads *"Generated when you save a webhook URL"* until one exists — the **Generate** button beside it mints one.

### Verifying the signature

Every delivery carries an `X-MB-Signature` header so you can prove it came from MessageBlue:

```text
X-MB-Signature: v1=<hex>
```

The hex value is:

```text
HMAC-SHA256(signing_secret, "{X-MB-Timestamp}.{raw body}")
```

Sign over the **raw request bytes**, not a re-serialized JSON parse. Parsing and re-encoding JSON reorders keys and changes whitespace, which produces a different digest and a signature that never matches. Capture the body before your framework touches it.

The **signing secret** is generated the first time you save a webhook URL. Like the app secret it is shown once, and **Regenerate** mints a new one that takes effect immediately — update your server before the next event arrives.

### The delivery contract

Respond **2xx within 10 seconds**. Anything else counts as a failure and is retried. Do the minimum in the handler — acknowledge, queue, and process out of band. Deliveries that exhaust their retries are dead-lettered and listed in [Failed webhooks](/failed-webhooks), where you can inspect and replay them.

## API & secrets

The three values that identify and authenticate your app:

| Value          | Visible here         | Notes                                                                               |
| -------------- | -------------------- | ----------------------------------------------------------------------------------- |
| **Account ID** | Always               | Copyable                                                                            |
| **App ID**     | Always               | Copyable                                                                            |
| **App Secret** | Never after creation | Shows *"Secret on file — regenerate to reveal a new value"*, or *"Not created yet"* |

The secret signs HMAC requests to the messaging API — see the [API reference](/api-reference) for how to construct a signed request, or try one in the [API Console](https://api.messageblue.ai/docs).

![Settings API and secrets tab showing Account ID and App ID with copy buttons, and a Secret field reading Secret on file, regenerate to reveal a new value](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/1cd2528cb96072ebe1d70c1c261abdc1d3c63556d9e4553be29f6e1b49e1f397/docs/assets/frontend/settings-api-secrets.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=d9b0099cd3cb673ab1c3b1a8ef7c4fe7aa6c935c0be7a7eee9c1cf139ea834c8&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Account ID and App ID each have a **copy** button. The Secret field is not a masked value you can reveal — the secret genuinely is not stored anywhere retrievable, which is why the field explains itself rather than offering an eye icon.

### Regenerating

Regeneration is immediate and has no grace period:

> The current secret stops working immediately. Any server still signing requests with it will start failing, so roll the new value out before regenerating.

Have the deployment ready to accept the new value *before* you press the button, not after.

The confirmation spells out the consequence and colours the destructive action red:

![Regenerate API secret dialog warning that the current secret stops working immediately, with Cancel and a red Yes, regenerate button](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/3f803a188c01e1cc45725ea284a83af7fcfa33d09bf120c3639c1e2eff756865/docs/assets/frontend/settings-regenerate.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=14f4d7b84da71b5851d271c65f17737ed4d6ec71bd69b36207266b9876bc897a&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

The replacement is displayed once afterwards, in a dialog with a **Copy secret** button. There is no way to retrieve it later — losing it means regenerating again.

The webhook signing secret has an identically-shaped confirmation, with the same immediacy: *"Your current webhook signing secret stops working immediately."*

## Zapier CRM

The fourth tab. It describes itself plainly:

> Connect MessageBlue to Zapier using your App ID and a dedicated Zapier secret. Use these in your Zapier Platform app connection fields.

It shows three values and one control:

| Value             | Notes                                                                         |
| ----------------- | ----------------------------------------------------------------------------- |
| **Account ID**    | Shown for reference and support. **Not** needed by Zapier                     |
| **App ID**        | Copyable — one of the two values Zapier asks for                              |
| **Zapier secret** | *"Secret on file — regenerate to reveal a new value"*, or *"Not created yet"* |

**Generate Zapier secret** creates one; once it exists the button becomes **Regenerate Zapier secret**.

The Zapier secret is **separate** from the App Secret on the [API & secrets](#api-and-secrets) tab and from the [webhook signing secret](#webhooks). Rotating one does not affect the others — but rotating the Zapier secret does break every live Zap until each connection is updated:

> The current Zapier secret stops working immediately. Any active Zaps using it will fail until you update the connection.

Like every other secret in MessageBlue, it is displayed exactly once, with the reminder *"Copy it now — it is shown only once. Paste into your Zapier connection as the API key / secret field."*

For what to do with these values, see [Set up Zapier](/zapier-messageblue-integration-setup).

## HubSpot CRM

Private beta

**The HubSpot CRM tab** is in private beta and is not enabled on every account yet. Ask your MessageBlue administrator or support team for access.

The fifth tab links this MessageBlue app to a HubSpot portal, so iMessage conversations appear in **HubSpot Conversations**. It describes itself as:

> Connect this MessageBlue app to your HubSpot portal once. Inbox replies and conversation sync use that mapping automatically — no HubSpot secret in MessageBlue.

![Settings HubSpot CRM tab showing an App ID field, a Status line, and Connect HubSpot and Refresh status buttons](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/fb291003bf8030036072830b571879ef106fdff5f796c93f8ec1f2bcb7c12350/docs/assets/frontend/settings-hubspot-crm.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=0ae748593956aac7acd64e9693f997122ef30ae21b95625b56baaeb947769a57&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

Unlike [Zapier CRM](#zapier-crm), there is **nothing to copy** — no secret is generated and none is pasted. The tab shows two values and two controls:

| Value      | Notes                                                                                                                                                                            |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **App ID** | The MessageBlue app being linked. Quote it to support; it is not a credential                                                                                                    |
| **Status** | *"HubSpot service is not configured on the backend yet."*, *"Not connected. Connect once to link this app to HubSpot."*, or **Connected** with the Portal ID and channel account |

**Connect HubSpot** opens HubSpot's authorization screen in a new tab; the same button reads **Reconnect HubSpot** once a portal is linked. **Refresh status** re-reads the connection — though status also refreshes by itself whenever you return to the MessageBlue tab.

Below it, **New conversation** sends an iMessage and opens or continues the matching HubSpot thread. Its fields stay disabled until a portal is connected.

![New conversation card with Recipient phone and First message fields and a Create conversation button, all disabled](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/message-blue.docs.buildwithfern.com/9e2d8556ff8959c201456a8e495e6e4204b890de77b69c465078f584092d43bd/docs/assets/frontend/settings-hubspot-new-conversation.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260916%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260916T201133Z&X-Amz-Expires=604800&X-Amz-Signature=6e537f792ef3b77587d94c4fd66e495bbc48e3dea25a6dad3eec231387c159ed&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

For the full flow, see [Set up HubSpot](/hubspot-messageblue-integration-setup).