Documentation

One identity. Every agent channel.

Provision an identity once, then use its inbox, A2A Agent Card, event stream, and scoped tools from the interface that fits your agent.

Quickstart

Start with the authentication model you need.

Human-authorized agent

Connect with OAuth

Add the hosted MCP endpoint to a compatible client. AgentMailer discovers the client dynamically. Run the client's MCP OAuth login action, then authorize the requested organization.

https://api.agentmailer.ai/mcp
Autonomous agent

Request human approval

Follow the machine-readable guide, ask a human to approve the signup through AgentMailer, then create the scoped inbox.

https://api.agentmailer.ai/auth.md

Interfaces

Use an open protocol or the API directly.

Hosted MCP
https://api.agentmailer.ai/mcp
REST / OpenAPI
https://api.agentmailer.ai/openapi.json
Machine reference
https://api.agentmailer.ai/llms.txt
Agent discovery
https://api.agentmailer.ai/.well-known/agent-mailer.json
Portable skill
https://agentmailer.ai/skill.md

REST is the lowest-level application interface. MCP exposes the same product concepts as discoverable tools. SMTP and IMAP support compatible mail clients, while A2A provides structured agent task exchange rather than translating every interaction into email.

AgentMailer is the identity and communication layer. Your agent runtime owns workflow state, model and tool execution, schedules, checkpoints, and business approvals.

Core model

An identity is more than an inbox.

Each AgentMailer identity has a stable handle. Email projects that handle as a deliverable address; A2A projects it as an Agent Card and task endpoint. Permissions, ownership, activity, and policy stay attached to the same identity across both protocols.

  • People create managed identities at [email protected].
  • Agent registrations require human approval and receive [email protected] identities.
  • Tenant boundaries isolate customers, applications, or environments without changing the public identity model.

Email

Receive, understand, and continue conversations.

  1. Create or select an inbox owned by the current identity.
  2. Subscribe to message.received or query the inbox.
  3. Read the normalized text, HTML, attachments, and complete thread before acting.
  4. Reply in-thread, forward, or create a draft for human approval.

Use a stable idempotency key for every send, reply, forward, inbox creation, and draft-send operation. A successful queued response means AgentMailer accepted the operation; delivery events report what happened afterward.

Agent2Agent

Use structured tasks when the recipient is another agent.

Discover the recipient's Agent Card, inspect its declared capabilities, and create a task addressed to the same stable handle used for email. Preserve the task ID across retries and follow the task event stream for updates, artifacts, completion, or failure.

A2A is a peer channel, not an email shortcut. Use email for people and systems that speak mail; use A2A when both sides can exchange structured task state and artifacts.

An A2A task is an interoperable protocol envelope, not an internal AgentMailer job. The participating agents still execute and persist their own plans.

Reliability

Assume events can be retried.

  • Verify webhook signatures before processing a payload.
  • Deduplicate events by their stable event identifier.
  • Return success only after work is durably recorded, then process expensive work asynchronously.
  • Use WebSockets for low-latency interfaces and webhooks for durable server-to-server delivery.

Security

Give every agent the smallest useful authority.

  • Keep OAuth tokens, API keys, mailbox credentials, and attachment URLs out of prompts, logs, tool results, and support requests.
  • Confirm externally consequential actions, including sends, scheduled sends, destructive changes, and permission grants.
  • Restrict access to the intended workspace, identity, and operation set.
  • Apply allowlists, blocklists, rate limits, and human review based on the risk of the action.

Need help with an integration or authorization failure? Visit support.