Email inboxes for AI agents

What it is

An inbox is an address like amberwolf482@alias.utilarium.app. You make it with a personal API token. Mail to it is stored for 7 days. For each mail, the API gives the sender, the subject, the text, the HTML, the names of the attachments, the one-time codes and the links. An agent can sign up on a site, wait for the code, and go on.

The API is described in an OpenAPI document. The same facts are in llms.txt.

Quick start

1. Sign in on the start page, go to API tokens, and press “Make a token”. Copy the token. The page shows it only once. You can have 3 tokens.
2. Put the token in a variable.

export ALIAS_TOKEN=alias_...   # the token you copied

Every request sends the token in the header Authorization: Bearer <token>. It needs no cookie.

Make an inbox

A token can have 10 inboxes. The label is optional.

curl -s -X POST https://alias.utilarium.app/v1/inboxes \
  -H "Authorization: Bearer $ALIAS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label": "signup test"}'

# {"id": "6f1c...", "address": "amberwolf482@alias.utilarium.app", ...}

Wait for mail

Use the address on a site. Then ask for the mail of the inbox with since. Use the time of the newest mail that you have, or the time you started. Ask again after a few seconds. The list is empty until a new mail comes.

curl -s "https://alias.utilarium.app/v1/inboxes/$INBOX_ID/messages?since=2026-11-02T10:00:00Z" \
  -H "Authorization: Bearer $ALIAS_TOKEN"

# {"messages": [{"id": "...", "subject": "Your code",
#   "codes": [{"value": "482913", "rule": "default"}],
#   "links": [{"url": "https://shop.example/verify?t=1", "kind": "verify"}],
#   "received_at": "2026-11-02T10:00:07.000Z", ...}], "next": null}

Read the codes and the mail

The codes and the links are in the list already. To read the text and the HTML, ask for one mail. To delete it, use DELETE on the same address.

curl -s https://alias.utilarium.app/v1/messages/$MESSAGE_ID \
  -H "Authorization: Bearer $ALIAS_TOKEN"

Codes, links and own rules

The default rules find numbers of 4 to 8 digits, and words of 6 to 8 capital letters and digits with at least one digit, that stand near a word such as code, OTP, verification, PIN, passcode or one-time. They also read the subject. Links come from the text and from the HTML. Each link can have a kind: verify, confirm, activate, magic, login, reset or unsubscribe.

You can add up to 5 own rules to an inbox. A rule has a name, a pattern (a JavaScript regular expression) and a target: subject, text or html. The first capture group, or else the whole match, is the value. The rules read the first 64 KB of the target. The result is in the matches list.

curl -s -X PATCH https://alias.utilarium.app/v1/inboxes/$INBOX_ID \
  -H "Authorization: Bearer $ALIAS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rules": [{"name": "order", "pattern": "Order #(\\d+)", "target": "subject"}]}'

Limits

API tokens for each account

3

Inboxes for each token

10

Mails received each day for each token

100

Days a mail is kept

7

API requests each minute for each token

120

Size of one mail

5 MB

Own rules for each inbox

5

Over the daily limit, the sender gets a refusal, and the mail is not stored. Over the request limit, the API answers 429. Errors are JSON: an error object with a code and a message. Limits are monitored. They may go up automatically, or on request. To ask for more, write to kamadorueda@gmail.com.

Webhook through Hooks

An agent does not need to ask for mail. Make a source in Hooks, and set its address as the webhook_url of the inbox. The address must be https://hooks.utilarium.app/in/ and 16 letters or digits, with an optional path. When a mail comes, Email aliases sends this event to Hooks. Hooks keeps the event and delivers it to your target, and tries again if the target fails.

curl -s -X PATCH https://alias.utilarium.app/v1/inboxes/$INBOX_ID \
  -H "Authorization: Bearer $ALIAS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"webhook_url": "https://hooks.utilarium.app/in/<your 16 characters>"}'

{
  "type": "message.received",
  "inbox_id": "6f1c...",
  "address": "amberwolf482@alias.utilarium.app",
  "message": {
    "id": "...",
    "from": "no-reply@shop.example",
    "subject": "Your code",
    "received_at": "2026-11-02T10:00:07.000Z",
    "codes": [{ "value": "482913", "rule": "default" }],
    "links": [{ "url": "https://shop.example/verify?t=1", "kind": "verify" }],
    "matches": []
  }
}

What the server keeps

The server keeps the mail of an inbox for 7 days: the text, the HTML, the sender, the subject and the names and sizes of the attachments. It does not keep the attachment files. Only the owner of the token can read the mail. To delete a mail earlier, delete the mail, the inbox or the token. Read the privacy page for the details.

Questions