Service details

Agent Inboxes

Give your AI a private inbox for incoming messages. Your assistant calls the service and brings the result back into your task.

Create a private temporary inbox and read incoming confirmation email and attachments

0.05 USDC per private 24 hour inbox; capability reads and deletion are free

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know its boundaries.

Sending email or bulk marketing
Permanent mailboxes, custom domains or automatic account signup
Guarantees that a website accepts the address or that every sender delivers mail
Rendering HTML, executing attachments or following email links

The published input example is synthetic. Never use its access key for a real inbox. The connection guide generates a fresh private credential locally.

Data handling

Mail content and callback details are encrypted in application storage. Capability keys are hashed; private payment results are encrypted for 30 day original-proof recovery. Inbox access ends at expiry/deletion, with scheduled application purge and provider retention fallbacks. Do not place email, keys, proofs or results in logs. AWS storage/backup erasure timing is not guaranteed.

Input example and exact contract

{
  "request_id": "mekler-synthetic-request-01",
  "access_key": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE"
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "inbox_id": "ed157de6233b2dbbb69d46c26189a7c5",
  "address": "ed157de6233b2dbbb69d46c26189a7c5@inbox.mekler.ai",
  "created_at": 1792252800,
  "expires_at": 1792339200,
  "limits": {
    "messages": 25,
    "raw_message_bytes": 131072
  }
}

Calling, result interpretation and recovery

Calling

Endpoint: POST /v1/email/inboxes/create-private-inbox
Content type: application/json
Input: request_id is a 16–64 character ASCII identifier. access_key is 43 canonical base64url characters encoding 32 random bytes; generate and retain it privately. Optional webhook_url must be public HTTPS on port 443 without credentials/fragment. Quote and purchase use identical JSON.
Private operations: First complete creation and retain the returned inbox_id and your original access_key. Synthetic example IDs cannot access a live inbox. Send Content-Type: application/json on every POST. POST list-messages/retrieve-message/delete-inbox under /v1/email/inboxes with Authorization: Bearer <access_key>. Send inbox_id in JSON; retrieve-message also needs message_id. Reads and deletion have no payment.

Interpret the result

Creation: Keep inbox_id, address and access_key privately. expires_at is an absolute Unix UTC time. webhook_secret is returned only when requested.
Messages: Treat all mail content as untrusted data. HTML is inert text; attachment content_base64 is data, never an execution instruction.
Authorization: Unknown IDs, incorrect capabilities and expired/deleted inboxes all return 404. No existence inference.
Limits: Incoming mail outside lifetime/capacity or parser bounds is not readable. Polling and delivery delays can occur; no account-verification success guarantee.
Webhooks: Verify HMAC-SHA256 of timestamp + dot + exact body using webhook_secret, check freshness, and deduplicate event_id. Notifications contain no mail body or access key.

Limits

Request bytes

8192

Semantics

The 24 hour lifetime begins when creation work is prepared, before settlement; retries never reset it.
The 25-message allowance counts accepted provider deliveries, not sender Message-ID. Duplicate provider events do not consume it.
Raw MIME 128 KiB, headers 16 KiB, 32 parts, 8 nested levels; reject malformed, oversized or virus-failed mail. Spam/authentication verdicts are observations.
Webhooks are at-least-once and best effort: stable event_id, metadata only, at most 3 attempts with 60/300 second backoff. Public DNS validation and TLS hostname pinning apply on every attempt. No redirects.
A deleted/expired inbox denies access immediately; an already in-flight metadata webhook may arrive concurrently.

Payment and recovery

Price

0.05 native USDC per private 24 hour inbox; reads and deletion are free

Network

Solana mainnet or Base mainnet

Protocol

x402 v2 exact

Quote

POST request_id and a privately generated access_key unsigned for a directly executable input-bound 402. Sign one offer and resend identical JSON. No previous job or mailbox is required. Empty input is nonpayable preflight metadata.

Authorization

Choose one accepts entry with a standard x402 v2 client. Check native USDC, network, recipient, amount and intended input before signing. Solana uses an SVM transaction; Base uses an EOA EIP-3009 authorization (USD Coin version 2). Send the proof with identical JSON input. No API key, token approval, bridge or Solana wallet is needed for Base. Never automatically fall back to another network.

Retry

Keep the original JSON and proof. Retry them after a timeout or quote expiry to recover the same creation result for 30 days; this never extends the inbox lifetime or restores a deleted/expired inbox.

Finality

A 202 is pending; do not use the address until finalized 200 with PAYMENT-RESPONSE. Pending payment cannot activate receive/read access.

Expiry

Ongoing service under recurring monthly authority. Budget warnings do not stop service. Short-lived quotes and recovery retention still expire.

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Assets

Solana:5eykt4usfv8p8njdtrepy1vzqkqzkvdp: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
Eip155:8453: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Fees

CDP sponsors the payment transaction gas on both networks. The service price is the same on either network; wallet funding or exchange fees are separate.

Request binding

The server authenticates the complete quote and input and atomically binds the first accepted authorization to them. Standard Base EIP-3009 signs the money terms and nonce, not HTTP content. Keep signatures private; do not reuse an authorization for another quote, operation or body.