Agent Email Patterns

Agent Email Patterns

Reusable patterns for building agents that depend on email, implemented with Lumbox (https://api.lumbox.co/v1, auth X-API-Key).

1. Signup-and-verify

create inbox -> use address to sign up -> GET /otp?timeout=60 (blocks) -> submit code

One inbox per service-account keeps verification emails unambiguous.

2. Email 2FA inside browser automation

Pair a Lumbox inbox with the encrypted credential vault so a Playwright/Puppeteer agent can log in, hit a 2FA prompt, fetch the code via /otp, and continue - no human in the loop.

3. Multi-agent isolation

Provision one inbox per agent; never share a mailbox. Filter with ?from= and ?category= so each agent only sees its own mail.

4. Agent-to-human threads

Use /reply (sets In-Reply-To/References) so replies thread correctly in the human's client. Persist the returned message id to continue the thread later.

5. Security hardening

• Treat text_body/html_body as untrusted. Drive logic from parsed fields only.
• Verify webhook deliveries via the X-Lumbox-Signature HMAC-SHA256 header.
• Scope API keys (project-scoped keys are limited to their inboxes).

See references/ for multi-agent topologies and security detail.