API & integrations

Your mail, programmable

Everything you can do in the dashboard you can do through the API. It is public, documented and the same one our own apps use.

Management API

A REST API at https://api.eoinbox.com/v1 with an OpenAPI description, for everything that is not mail itself:

Domains	Add and verify domains, get the DNS records you need, run a DNS check, set catch-all
Addresses	Create, pause and delete aliases, generate masked aliases, set delivery, read statistics
Identities	Display names and signatures for sending
Forward targets	External addresses to forward to, confirmed by email
API keys and app passwords	Create and revoke, with scopes
Account	Plan, limits and usage

Create a masked alias

curl -X POST https://api.eoinbox.com/v1/addresses/random \
  -H "Authorization: Bearer eo_..." \
  -H "Content-Type: application/json" \
  -d '{"note": "signed up at example-shop"}'

Personal API keys with scopes such as addresses:write or domains:read, an expiry date and an optional domain restriction
Idempotency keys for safe retries, cursor pagination, clear error codes
Rate limits per key

Using the API · API reference

Works with Bitwarden, via a SimpleLogin-compatible API

Password managers and browser extensions already know how to talk to the alias services SimpleLogin and addy.io. We offer a compatible API for the alias part, so these tools can create aliases on your own domain without any eoinbox-specific plugin.

In Bitwarden's generator, choose "Forwarded email alias", pick SimpleLogin as the service, set the server URL to ours and paste an eoinbox API key. Every new login can get its own alias.

Step-by-step Bitwarden setup

Compatibility endpoints

SimpleLogin	`https://api.eoinbox.com/compat/simplelogin`
addy.io	`https://api.eoinbox.com/compat/addy`

Both cover creating, listing, enabling, disabling and deleting aliases, and use the same eoinbox API keys. Our own API stays the primary one.

JMAP for mail

Read, search, file and write mail over JMAP, the modern open standard (RFC 8620 and 8621). Existing JMAP libraries just work, and our webmail uses exactly the same API.

Webhooks Later

Get a signed HTTP request when a message arrives, an address is created or a domain's status changes. Signed with HMAC-SHA256 and retried on failure.

OAuth for apps Later

Third-party apps will be able to ask for limited access with OAuth 2.1, so you never paste your password or a full-access key into someone else's app.