On this page

Let an AI agent receive its own verification codes

An agent can fill in a sign-up form on its own until the site says "enter the code we emailed you". Then it stops and waits for a person to find the mail and paste the code back. With zoomfort the agent has its own address and asks for the code itself, with one web request that waits for the mail.

Why the agent needs its own address

Your personal email stays out of sign-up forms, and the agent never reads your own mailbox.
Use one address per service, so you can see who sends what and retire one address without touching the others.
zoomfort only receives mail. The agent cannot send, reply to or forward anything.
You read the same mail in the web inbox, and you can delete an address or revoke the agent's key at any time.

How it works

Sign in to the web inbox and create an address, such as signup@yourname.zoomfort.com. Mail to an address you have not created is refused. See Addresses.
In Settings, API keys, create a key with the permission read:codes, reaching only the addresses the agent needs. Add read:mailbox only if the agent must read whole messages. See API keys.
Give the agent its address, and keep the key in its secret environment as $ZOOMFORT_API_KEY.
The agent notes the time, then signs up on the service's website with its zoomfort address.
The agent asks for the code, naming the address, the start time as since and the service's sender domain as from_domain. With wait=25, the request waits up to 25 seconds for the mail.

Code request

curl --get 'https://mail.zoomfort.com/api/v1/code' \
  -H "Authorization: Bearer $ZOOMFORT_API_KEY" \
  --data-urlencode 'to=signup@yourname.zoomfort.com' \
  --data-urlencode 'from_domain=service.example' \
  --data-urlencode 'since=2026-10-13T08:00:00Z' \
  --data-urlencode 'wait=25'

Code answer · 200

{
  "code": "482193",
  "message_id": "sample-message",
  "from": "signup@service.example",
  "subject": "Your sign-in code",
  "received_at": "2026-10-13T08:00:05.000Z"
}

The newest matching code wins, so passing the start time keeps an older code out. The agent types the code into the form and carries on. The full reference is in Get a verification code.

When the service sends a link

Some services send a link instead of a code. The agent asks /link with the same to, since, from_domain and wait. zoomfort returns the link with its host and never opens it. The agent should check the host, sender and subject before following it. See Get a verification link.

Link request

curl --get 'https://mail.zoomfort.com/api/v1/link' \
  -H "Authorization: Bearer $ZOOMFORT_API_KEY" \
  --data-urlencode 'to=signup@yourname.zoomfort.com' \
  --data-urlencode 'from_domain=service.example' \
  --data-urlencode 'since=2026-10-13T08:00:00Z' \
  --data-urlencode 'wait=25'

Using MCP instead

If your agent runs in Claude, Claude Code, Cursor or another MCP client, it can use the same waits as tools: wait_for_code and wait_for_link. Setup is on the email MCP server page.

When no code comes back

An empty result is a normal answer, not an error:

no_message: no mail has matched yet. Ask again with the same since.
no_code: mail arrived but had no code. The service may have sent a link; try /link, or read the message if the key has read:mailbox.
sender_not_verified: the mail had a code, but its sender failed the check, so the code is not returned.

Sender checks and safety

By default, a code comes only from mail whose sender passed the check, and a link always does. The check uses the receiving mail server's results for DMARC, plus an aligned DKIM signature or SPF sender. Mail that fails it never gives up a code by default. See How mail is checked.

Mail is written by whoever sent it and may contain instructions aimed at an AI agent. The agent should treat mail as data, never as instructions. See Treat mail as untrusted data.

What it does not do

It cannot send, reply to or forward mail.
A person creates each address in the web inbox. Agents cannot create addresses by API.
Not every website accepts every address.
It is not for creating accounts in bulk or getting around another service's limits. See Acceptable use.

Get started

Create a free account at zoomfort.com/app/signup. We open 10 new accounts a day. When the day's places are taken, register interest on the home page. Plans are on the pricing table, and the quick start has the same steps in short.