AgentMailer
Sign inCreate an identity

Documentation / Enterprise

Manage AgentMailer access through Claude.

Authorize the connector centrally, assign it to the right Claude roles, and keep each person inside their AgentMailer organization and workspace boundaries.

Open Claude admin Review security

Overview

Central access without a shared mailbox or password.

AgentMailer uses OAuth 2.0 for the hosted MCP endpoint. Claude can authorize the connector for selected organization roles while AgentMailer continues to enforce the signed-in person's organization membership, workspace access, and tool permissions.

Connector
AgentMailer
Remote MCP URL
https://api.agentmailer.ai/mcp
Authentication
OAuth 2.0 with PKCE and refresh tokens
Access boundary
Organization, workspace, identity, and operation

Prerequisites

Decide the pilot boundary before connecting.

  • A Claude Team or Enterprise organization.
  • An Owner or Primary Owner who can configure connectors.
  • An AgentMailer organization with the intended workspaces.
  • A Claude role or pilot group whose members should inherit the connector.
  • An approved scope set for reading mail, managing drafts, sending, destructive actions, and A2A communication.

Claude configuration

Enable managed authorization for AgentMailer.

  1. In Claude, open Organization settings, then choose Connectors and AgentMailer.
  2. On the connector's Configuration tab, choose Set up beside Managed authorization.
  3. Complete the identity-provider connection requested by Claude, then run Claude's connection test.
  4. Assign a pilot role first. Expand to built-in or additional custom roles after the test users complete the workflow below.
  5. Select only the AgentMailer permissions those roles require, then save and turn on managed authorization.

Browser sign-in may remain enabled as a fallback during rollout. Claude attempts managed authorization first when both methods are available.

Permissions

Separate reading, communication, and destructive work.

Baseline

Read and prepare

List identities and inboxes, read messages and threads, search, inspect attachments, and create or update drafts.

Elevated

Communicate and delete

Send email, reply, forward, exchange A2A tasks, and remove records only for roles whose workflows require those actions.

Validation

Prove the boundary with a disposable workflow.

  1. Connect as a member of the pilot role and call `auth_me`.
  2. Confirm the expected AgentMailer organization, workspace, and permissions are returned.
  3. Create two disposable identities and send a test message between them after approving the recipient and content.
  4. Read the resulting thread, prepare a draft, and test one A2A task.
  5. Confirm a user outside the pilot role does not inherit the connector.

Lifecycle

Remove access at the narrowest responsible layer.

  • Remove a Claude role assignment to stop inheriting the connector.
  • Disconnect AgentMailer in Claude to revoke the user's connector session.
  • Remove organization or workspace membership in AgentMailer to revoke access at the resource boundary.
  • Rotate or revoke credentials after suspected compromise and review recent activity before restoring access.

Need help with a rollout or authorization failure? Contact [email protected].