DocsConsole

[ inbound email // api-first ]

Email identities for automated operations.

Create persistent email addresses, receive messages, extract verification codes, and connect email to your software through a single API.

Get started →Read the docs

[ fig. 1 — one message, end to end ]

Inbound email
security@vendor.com
Identity
acme-billing@
Extract
otp 482913
  • Webhookmessage.received, signed
  • Forwardops@you.com
  • Storeinbox + api

  1. Identity API

    A persistent address with a stable id for every account, agent or test run. Plus-addressing routes name+run-42@ to the same identity.

    Now
    Create, update, disable and delete identities over /v1, with external ids and metadata
    Next
    Bulk create

  2. Inbound email

    Every identity receives real mail through Cloudflare Email Routing, or through one authenticated endpoint for your own provider. Messages are deduplicated and stored before anything else runs.

    Now
    Cloudflare Email Routing with a retry queue, raw MIME kept 30 days, Resend inbound, generic JSON
    Next
    Attachments, custom domains

  3. Verification extraction

    Rules find 4–8 digit and alphanumeric codes, sign-in, confirmation and reset links, and any stated expiry. Only when they find candidates but can't decide, two models must agree on one of them, and it is checked again.

    Now
    Codes, links, confidence, expiry, model fallback for ambiguous mail
    Next
    Provider templates, custom rules

  4. Webhooks

    message.received events with extractions attached. Signed with a per-endpoint secret over timestamp and body, or public. Exponential backoff, dead-letter after 8 attempts.

    Now
    Signed or public, retries, filters
    Next
    Secret rotation, replay, history

  5. Developer experience

    JSON over HTTPS with structured errors. A verification session lets a job wait for the next matching code, never an older one, without running its own polling.

    Now
    /v1 with scoped, rate-limited API keys, verification sessions, OpenAPI, TypeScript SDK
    Next
    SDK on npm

[ fig. 2 — what your software receives ]

The code arrives already parsed. Verify the signature, read extractions[0].value, continue the job.

Webhook delivery
POST https://your-app.com/hooks/sendir
x-sendir-event: message.received
x-sendir-timestamp: 1792605600
x-sendir-signature: 5f2b…  # signed destinations: HMAC-SHA256("{timestamp}.{body}")

{
  "type": "message.received",
  "message": {
    "id": "c0a8…",
    "identityId": "7d1e…",
    "from": "security@vendor.com",
    "to": "acme-billing@sendir.email",
    "subject": "Your sign-in code",
    "receivedAt": "2026-10-21T18:00:00.000Z"
  },
  "extractions": [
    {
      "type": "otp",
      "value": "482913",
      "confidence": "high",
      "expiresAt": "2026-10-21T18:10:00.000Z"
    }
  ]
}