Get an API key

Use case

AI agents that sign up for services and verify email

Research agents, browser agents and coding agents keep hitting “check your email for a code”. Give them an address, and make reading the code one call.

An agent that uses the web on someone’s behalf eventually meets a sign-up form, a login that sends a one-time code, or a “confirm your email” link. Using the user’s own mailbox for that means OAuth scopes over years of private mail. Giving the agent its own address keeps the two apart, and Agentboxd reads the code out for it.

#The flow

  • Pick the address. A temporary inbox for a one-off sign-up (receive-only, self-deleting, on tmp.agentboxd.com), or a permanent inbox with a client_id when the agent will log in to the service again and needs the same address.
  • Note the time, then submit the form with the address. The time matters: the wait only counts mail that arrives after since.
  • Wait for the code. waitForVerification (TypeScript), wait_for_verification (Python) or the get_verification_code MCP tool long-polls up to 60 seconds and returns code, link and confidence.
  • Finish the sign-up with the code, or by opening the link.

#With curl

shell
# 1. A throwaway, receive-only address for this one sign-up
curl -s https://api.agentboxd.com/v1/inboxes -H "Authorization: Bearer $AGENTBOXD_API_KEY" \
  -H "Content-Type: application/json" -d '{"ttl_seconds":900}'
# → {"id":"7f3c…","address":"k3v9q2m8x1ab@tmp.agentboxd.com","temporary":true,"expires_at":"…"}

SINCE=$(date -u +%Y-%m-%dT%H:%M:%SZ)   # 2. before the agent submits the form
# 3. … the agent signs up with k3v9q2m8x1ab@tmp.agentboxd.com …

# 4. Wait up to 60 s for the code or magic link
curl -s "https://api.agentboxd.com/v1/inboxes/7f3c…/verification?since=$SINCE&from=acme-cloud&timeout=60" \
  -H "Authorization: Bearer $AGENTBOXD_API_KEY"
# → {"data":{"code":"731904","link":null,"confidence":1,"from":"Acme Cloud <no-reply@acme-cloud.example>",…}}

#How the code is found

Extraction runs on our server for every inbound message. A number or code only counts when it sits near a word such as “code”, “verification” or “one-time”, and anything that looks like a phone number, date, price, year or order number is dropped. That gives a confidence up to 0.7. With AI processing on, a classifier then answers “is this a login, one-time-code or confirm-your-email message?”, and raises the confidence to at least 0.95 when it agrees, or drops it to 0.2 or less when it doesn’t. Magic links are scored by their anchor text and path (verify, confirm, magic, sign in), with unsubscribe and tracking links excluded.

#Keep it safe

  • Only use a code for a sign-up the agent started. A code in an email the agent didn’t expect is a phishing signal, not an instruction; the MCP server tells models the same.
  • Filter by sender with from (a substring of the From header), so another email arriving at the same time can’t answer the wait.
  • Respect the service’s terms. Some don’t allow automated sign-ups; an agent should stop at a CAPTCHA rather than try to defeat it.
  • Use a key scoped to the inbox or to the permissions the agent needs, so a prompt-injected agent can’t reach other inboxes.

#Build it

Guides

Docs

Other use cases