Let an agent set up an inbox

You can start directly at mailly.site/onboard using the same API; no agent is required. Or give this prompt to an agent with HTTP access. It asks for your preferred name if it doesn't know it, reserves it, and gives you the verification link. Once you confirm, it receives the address and your account's API key. No CLI, MCP, existing account or copied API key is required. The full instructions the agent follows are at mailly.site/auth.md.

Read https://mailly.site/auth.md
and set up a Mailly inbox for me over HTTP.
Ask me for the name if unknown; if taken, ask for another,
with no blind retries.
Send me the verification link.
After I confirm the inbox in my browser,
store the API key securely, tell me the address,
and ask me before sending any email.

Sign in or register with your verified external email (not mailly.site or a subdomain), open its magic link yourself, then explicitly bind the chosen inbox within your account quotas. Confirming is what hands the agent your account's API key, so deny the request if you didn't ask an agent to set one up. The agent must not verify, confirm or read your external inbox to redeem the link for you.

Name rulesCopy Anchor Link

• Names are trimmed and lowercased, 3–64 characters from a-z0-9._-, and start and end with a letter or digit.
• System and official names such as admin, support, info and sys are rejected (compared ignoring ._-).
• A name is reserved for 30 minutes against existing inboxes and pending reservations. On 409 code=name_taken, ask for another name; never blindly mass-retry.
• Expiration or cancellation releases the name. A reservation creates no user or receiving inbox; anonymous receiving and reading are deferred.
• Never substitute an existing inbox or an auto-generated name; there is no multi-inbox selection.

The HTTP flowCopy Anchor Link

POST https://api.mailly.site/onboarding/start  # no auth
Content-Type: application/json
{"name":"chosen-name"}
# address: "chosen-name@mailly.site"
# request_id, verification_url, status_url, setup_token
# expires_in: 1800, interval: 5
# 409 code=name_taken: ask for another name, no blind retries
GET <status_url>  # Bearer setup_token; every >=5 seconds
# ready: {success: true, status: "ready", address: {id, address}, api_key, hint}
# Store api_key securely; report the address.

The temporary setup_token only polls this setup; keep it private to resume. Poll at least 5 seconds apart:

Setup expires after 30 minutes; a ready result stays retrievable for 10 minutes after the person confirms.

After setupCopy Anchor Link

The agent sends the key as Authorization: Bearer <api_key> to the HTTP API, or logs in to the CLI with mailly login <api-key>. It keeps the key out of chat, logs and committed files, and asks you before sending, replying or forwarding mail. You can see the same key at /app/developers. Remote MCP uses its own OAuth sign-in instead of the key.