apumail
the chasqui mail relay

Mail your agents
can use end‑to‑end.

Provision an inbox in one POST. Verification codes, OTPs, signup confirms — delivered to your agent in JSON, with the code already extracted. Send replies from the same address. No forms, no spam, no glue.

Sign in with notlogin → See how it works →
Prowl agent-readiness score Notlogin auth ✓ Accepts agent credentials ✓
✓ provisioned · expires 24h after last activity
Address
Token
Token shown once — copy it now. Or open the dashboard to keep it in your browser.
vivid-llama-4a2c@apumail.com 3 NEW
noreply@stripe.com12:04
Your Stripe verification code
otp →482910
auth@github.com12:03
[GitHub] Sign-in confirmation
otp →789314
team@notifications.resend.com12:01
Confirm your account
otp →216477
zsh
$ curl -sS .../inbox/$ADDR/wait
← { otp: "482910" }
488signups
471mails sent
25MCP tools
24hfree TTL
50MBmax per mail
~600msAPI latency
built for Claude Code Cursor Codex LangChain n8n any MCP client
01/See it run

Two calls, start to OTP.

The whole product in one session: provision an inbox, hold a long-poll open, and take the verification code back as JSON — no inbox to open, no human in the loop.

api.apumail.com 
curl -sX POST https://api.apumail.com/api/v1/inboxes
{ "address": "brisk-vicuna-a41f@apumail.com",
  "token": "kQ8vN2xR…", "ttl_seconds": 86400 }
 
curl -s -H "Authorization: Bearer $TOK" ".../inbox/$ADDR/wait?timeout=120"
… holding the connection open until mail lands
{ "from": "noreply@stripe.com",
  "subject": "Your verification code",
  "otp": "418902" }
01
Provision
One POST, no signup. Address + token back in ~600ms.
02
Receive
Any SMTP sender delivers straight to the agent.
03
Extract
OTP parsed server-side, handed back in the JSON.
04
Reply
Send back out from the very same address.
02/Receive

Mail in. Code out.

SMTP listener on :25 accepts mail for any inbox you've provisioned. Random local parts get 550 5.1.1 — built-in spam gate. The otp field is server-extracted at save.

provision · long-poll · read ~600ms 
# 1. Provision (no auth required)
INBOX=$(curl -sS -X POST   https://api.apumail.com/api/v1/inboxes)

ADDR=$(echo "$INBOX" | jq -r .address)
TOK=$(echo  "$INBOX" | jq -r .token)

# 2. Block until a mail lands (≤ 300s)
curl -sS -H "Authorization: Bearer $TOK"   "…/inbox/$ADDR/wait?timeout=120"

# → { messages: [{ from, subject,
#     otp: "482910" }] }
vivid-llama-4a2c@apumail.com3 NEW
noreply@stripe.com12:04
Your verification code
otp482910
auth@github.com12:03
[GitHub] Sign-in confirmation
otp789314
team@notifications.resend.com12:01
Confirm your account
otp216477
03/Send

Reply from the same address.

One POST /send. The from field is forced to your inbox address — no spoofing. Rate-limited per-inbox and per-IP so a leaked token can't torch deliverability.

From-spoofing impossible by design.

The route reads the authenticated address from the path and overrides whatever from the body claims. Token A can not send as inbox B. Resend handles delivery; we handle the integrity.

5/hr per inbox · 20/hr per IP
100KB body · 50 recipients max
MIME via Resend · DKIM-signed
POST /api/v1/inbox/<addr>/send via Resend 
curl -X POST   -H "Authorization: Bearer $TOK"   -H "Content-Type: application/json"   -d '{
    "to": "user@example.com",
    "subject": "Re: Your verification",
    "text": "Confirmed — code 482910."
  }'   https://api.apumail.com/api/v1/inbox/$ADDR/send

# → { "ok": true,
#     "provider_id": "3c260b…" }
04/SMS

A number your agent owns.

Not just email. Buy a dedicated phone number on-demand for your country, then receive verification codes and send replies — the same long-poll, OTP-extraction and MCP layer as email (wait_for_sms, extract_latest_sms_otp, send_sms). Paid tier, no human in the loop.

Two-way SMS, bought on-demand.

One call buys a real number in the country you ask for — no pool to wait on, no human to email. Inbound texts land instantly and their OTP is server-extracted, exactly like email. Outbound from is forced to your own number (no spoofing), rate-limited per-number and per-IP.

paid tier · dedicated number, your country
receive · send · OTP auto-extract
30/hr send per number · 60/hr per IP
POST /api/v1/phones buy + wait 
# buy a number for your country
curl -X POST -H "Authorization: Bearer $ACCT"   -d '{ "country_code": "US" }'   https://api.apumail.com/api/v1/phones
# → { "number": "+1555…", "token": "…" }

# block until a code arrives, OTP pre-extracted
curl -H "Authorization: Bearer $TOK"   .../api/v1/phone/$NUM/wait
# → { messages:[{ otp: "482910" }] }
05/MCP + push

Native to your agent.

Twenty-five MCP tools at POST /mcp — Claude Code, Cursor, Cline, Codex, anything that speaks JSON-RPC 2.0. Or skip polling entirely with HMAC-signed webhook delivery.

⌨

MCP — 25 tools, zero glue code

One claude mcp add and your agent has email. Tools map 1:1 to REST endpoints, same shapes.

create_inbox
delete_inbox
wait_for_mail
read_inbox
extract_latest_otp
send_mail
register_webhook
list_webhooks
delete_webhook
claude mcp add --transport http apumail https://api.apumail.com/mcp
⚡

Webhooks — push, don't poll

Register a URL, get an HMAC secret (shown once). We POST every new mail with X-Apumail-Signature: sha256=<hex>.

mail arrives → apumail → HMAC sign
→ POST your URL
retry 3× · exp backoff · auto-disable @ 10 fails
SSRF guard rejects RFC1918 / loopback / GCP-metadata
A chasqui running an Andean mountain path with a llama, carrying a message.
why "apumail"

"The chasqui carries — digital messenger for AI agents."

Chasquis were the Inca relay-runners who carried imperial mail across the Andes, sprinting between rest stations. Apu is the Quechua word for the sacred-mountain spirit. We thought it fit a service that runs messages from wherever they're sent to wherever your agent is listening — fast, faithful, no infrastructure for the agent to install. The llama is on the badge because chasquis ran with llama-train support. The relay continues.

FAQ

Questions, answered.

Is it actually free?
Yes. Random-slug inboxes are free with a 24-hour idle TTL (any read or receive resets the clock). Outbound send is rate-limited per inbox + per IP to keep deliverability healthy. The only paid surfaces are vanity handles (<your-name>@apumail.com, from 4 USDC/yr) and custom-domain agent inboxes (<local>@agents.yourdomain.com, $12/yr — see below).
What happens to spam mail?
Mail to unprovisioned local parts is rejected at RCPT TO with 550 5.1.1 — that's the primary gate. Each connecting IP is also capped at 30 mails/minute. Subject/from/body fields are length-truncated. HTML is sanitized at save time with a conservative allowlist (no <script>, no javascript:, no <iframe>).
Can my agent reply to mails?
Yes — POST /api/v1/inbox/<addr>/send. The from address is forced to the authenticated inbox so a leaked token can't be used to spoof anyone else. Resend handles delivery; first sends often land in spam until apumail.com's reputation warms up.
How long do mails live?
Mails live as long as the inbox does. Free inboxes are reaped 24h after the last activity (read OR receive), and the FK ON DELETE CASCADE drops their mails. Paid permanent inboxes (claimed via apuchat handle) keep everything until you explicitly delete.
Can my agents receive on my own domain?
Yes — delegate a (sub)domain you control and your agents receive at <local>@agents.yourdomain.com, read through the same REST / long-poll / MCP / OTP layer. @apumail.com can look disposable and get blocklisted by signup flows; your own branded domain is a real, deliverable address you keep. Setup is two DNS records (a TXT ownership challenge + an MX to mail.apumail.com) — a subdomain is recommended so your apex corporate mail is untouched. It's inbound only (sending stays on apumail.com or your own provider). Each agent inbox is $12/yr in USDC, or $9.60/yr in $PROWL (20% off) — billed per agent, annually, paid right in the dashboard with your Solana wallet. Sign in with notlogin and open 🌐 Domains.
SMS too?
Yes, two-way — on the paid tier. One POST /api/v1/phones with a country_code buys a real dedicated number on-demand (no pool to wait on, no human to email). Then your agent receives verification codes — read through the same REST / long-poll / MCP / OTP layer as email (wait_for_sms, extract_latest_sms_otp) — and sends replies (send_sms), from locked to your own number. A number is $18/yr ($14.40 in $PROWL); sending costs $0.07/SMS from prepaid credit (top up in USDC/$PROWL) — or send without a number at all from a shared sender ID. Sign in with notlogin and open the 📱 SMS console.
What if I want to self-host?
Not the goal — apumail is hosted SaaS by design (one DNS record + one Resend account is enough setup pain for most teams). If self-host is a hard requirement, look at agenticmail — same problem space, Docker stack, MIT.

Stop polling Gmail.
Start using apumail.

Free random inbox, no signup, in one POST. Or sign in with notlogin to claim a custom name@apumail.com.

Sign in with notlogin →