Let your agent read its own verification codes

How it works

1. 01Create a mailbox the agent owns

   Order or connect a domain, provision a mailbox, and use that address wherever the agent signs up.

2. 02Issue a read-scoped key

   A per-inbox sm_live_ key with the read role - enough to receive, nothing else.

   Shell

   Show example

   # Keys are issued from the dashboard, not over REST - the issuance surface is
   # deliberately not agent-callable, so a leaked key can never mint or revoke
   # another. To get one: Dashboard → API keys → pick the mailbox + a role
   # (read / read_write / management) + an optional expiry → copy the sm_live_…
   # secret (it is shown ONCE). Then set it for your agent and pass it as the
   # Bearer token on every REST + MCP call:
   export SAIRAPH_MAIL_KEY="sm_live_…"

3. 03Trigger the action that sends the code

   Your agent submits the form / requests the login; the provider emails the OTP to its mailbox.

4. 04Fetch the code in real time

   A long-lived IMAP IDLE watcher surfaces new mail in near real time, with a poll fallback. When the agent is blocking, ?live=true fetches the body straight from source, falling back to cache if the source is briefly unreachable.

   cURL

   Show example

   # Blocking on a one-time code? Fetch inbound straight from the source.
   curl "https://mail.sairaph.com/api/v1/mailboxes/$MAILBOX_ID/messages?direction=inbound&live=true" \
     -H "Authorization: Bearer $SAIRAPH_MAIL_KEY"

5. 05Parse and continue

   Extract the code from the message body and resume the flow - no human in the loop.