The first thing an autonomous agent hits is a signup form, and the second is "we sent a code to your email". Here is how to give it an inbox that is really its own, on your domain, that you can read along with.
Why a disposable inbox is the wrong tool
The obvious shortcut is a throwaway address from a temp-mail service. It works for exactly one afternoon. The service the agent signed up for will send a password reset, a receipt, a "confirm this login from a new device" six weeks later, and the throwaway is gone. Many services also refuse disposable domains outright, so the signup fails before the code is ever sent.
An agent that acts for your company should sign up as your company: an address on a domain you own, in a mailbox that persists, that the people responsible for the agent can open. That last part is not a nicety. When the agent does something unexpected, the inbox is the audit trail.
Step one: create the mailbox
A person sets up the account once: a Faivelo account, a verified domain, and an API key from Settings, Developers, with the kind set to agent and the scopes mail:read, mail:send, mailboxes:read and mailboxes:write. Agent keys are sandboxed: the key can only reach mailboxes it created or was granted, never the rest of the account, and a key may create 10 mailboxes in 24 hours. The API is on every paid plan and on the trial.
Then the agent, or your code on its behalf, creates its own address:
curl https://faivelo.com/api/v1/mailboxes \
-H "Authorization: Bearer $FAIVELO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain": "yourcompany.com", "localPart": "agent-procurement"}'Name the mailbox for the job, not "bot". When the finance team sees agent-procurement@ in a vendor's CC line a month from now, the name should explain itself.
Step two: sign up, then read the code
The agent fills in the signup form with its new address. The service sends the code. Now the agent lists the newest messages in its inbox and reads the one that just arrived:
curl "https://faivelo.com/api/v1/mailboxes/agent-procurement@yourcompany.com/messages?folder=INBOX&limit=5" \
-H "Authorization: Bearer $FAIVELO_API_KEY"
# then, with the uid of the newest message
curl "https://faivelo.com/api/v1/mailboxes/agent-procurement@yourcompany.com/messages/<uid>" \
-H "Authorization: Bearer $FAIVELO_API_KEY"Extracting the code is the easy part. Most verification emails put a four to eight digit number on its own line or in the subject, so a regular expression such as \b\d{4,8}\b on the text body finds it; a "confirm your email" link is a URL containing the service's domain. If you are driving this from a model, the same read_message tool over MCP returns the text and the model picks the code out itself.
Give the poll a deadline (two minutes is generous) and give up loudly if nothing arrives, so a service that silently rejected the signup does not leave the agent waiting forever.
Step two, the long-running version
An agent that runs for days should not poll twenty mailboxes every five seconds. On the Pro and Business plans, add a webhook endpoint under Settings, Developers, Webhooks, subscribe to message.received, and narrow it to the agent's mailboxes. Faivelo posts a signed summary the moment mail arrives, with the sender, subject, a snippet and a message_id that works in the read call above. Verify the X-Faivelo-Signature header before trusting it; the SDK does that in one call. The full payload and retry rules are in how to receive email in your app.
if (event.type === 'message.received' && event.data.mailbox.startsWith('agent-')) {
const msg = await faivelo.messages.get(event.data.mailbox, event.data.message_id)
const code = msg.text?.match(/\b\d{4,8}\b/)?.[0]
if (code) await agent.resume(event.data.mailbox, { code })
}messages.get takes the mailbox address and the message id from the event.What the person responsible sees
Everything. The mailbox sits in your Faivelo account like any other. Open it in webmail and the signup confirmation, the receipts and whatever the agent sent are all there, threaded, searchable, in the Sent folder where they belong. Add it to Outlook or Apple Mail if you prefer. Revoke the key under Settings, Developers, and the agent loses access that second while the mail stays with you.
That is the whole case for an inbox on your own domain over a disposable one: you stay in charge, you see what the agent does, and the services it signed up for can always reach someone. Our piece on giving an AI agent an email address compares the four ways to do this, and email for AI agents has the plans.
An agent that signs up as a throwaway is a stranger. One that signs up as your company is staff.
If you are the agent reading this
The three calls you need are POST /api/v1/mailboxes, GET /api/v1/mailboxes/{address}/messages and GET /api/v1/mailboxes/{address}/messages/{uid}, all with Authorization: Bearer <key>. Errors come back as { "code", "error", "fix" }; branch on code and follow fix. The quickstart has every snippet in a form that runs as pasted, and the same page is available as markdown by adding .md to its URL.
Give it an address today
Start a trial, verify a domain, create an agent key, and the first mailbox is one POST away. Fourteen days, no card; after that every paid plan includes the API and unlimited mailboxes.