# Inboxr

> Email, SMS, and voice channels an AI agent can provision and read on its
> own — plus REST/SMTP/webhooks for developers and CI. Live at https://getinboxr.app.
> Inboxr is MCP-first: an agent calls create_inbox / sms_create_inbox to
> get a real mailbox or phone number mid-task, wait_for_message to block
> until the verification message lands, and extract_otp / extract_link to
> pull exactly what it needs — running signup-and-confirm flows end-to-end
> with no human relay. Every email inbox is a real, sendable address; every
> SMS inbox is a real phone number.

## Quick start

- Get an API key at https://app.getinboxr.app/api-keys (kept once at creation, hashed at rest).
- Validate: `curl -fsS -H "Authorization: Bearer $KEY" https://api.getinboxr.app/v1/inboxes`.
- For SMS, top up credits or pick an SMS plan at https://app.getinboxr.app/billing — required to claim a phone number.
- Try every endpoint live in your browser: https://app.getinboxr.app/docs/api (paste the key, click Run).

## Documentation

- [Integrations overview](https://getinboxr.app/llms-full.txt#integrations): REST, SMTP, MCP, webhooks — pick the one closest to your code.
- [API keys](https://getinboxr.app/llms-full.txt#api-keys): scopes (`read`, `write`, `admin`, `sms:send`, `sms:read`, `voice:call`, `voice:read`), rotation with 7-day deprecation, last-used IP audit.
- [Outbound email](https://getinboxr.app/llms-full.txt#outbound-mail): /v1/messages, plan caps, common 4xx/5xx.
- [Forwards](https://getinboxr.app/llms-full.txt#forwards): /v1/forwards (CRUD) — mail-to-mail aliases. Scope `forward:write` is **not** subsumed by `write` (least-privilege; leaked write keys can't redirect mail).
- [Domains](https://getinboxr.app/llms-full.txt#domains): /v1/domains (GET) — every domain this workspace can use (public + platform-granted + custom-verified). Read `read` scope.
- [SMTP submission](https://getinboxr.app/llms-full.txt#smtp): smtp.getinboxr.app:587 STARTTLS, per-inbox creds.
- [SMS](https://getinboxr.app/llms-full.txt#sms): /v1/sms/inboxes (claim a phone number), /v1/sms/send, claim-window routing, 5/sec/tenant + 60/min/phone rate limits.
- [Voice + IVR](https://getinboxr.app/llms-full.txt#voice): /v1/voice/calls to dial PSTN, /v1/voice/ivr-flows for state-machine call trees, AI flow generation from a description, OpenAI TTS, Whisper transcripts, opus recordings. 6¢/min outbound, 4¢/min inbound (in credits).
- [Webhooks](https://getinboxr.app/llms-full.txt#webhooks): events `email.received`, `sms.received`, `sms.delivered`, `voice.completed`, `voicemail.created`; HMAC-SHA256 signed; 1s/10s/1m/10m/1h/6h backoff with DLQ. Manage subscriptions via `GET/POST /v1/webhooks`, `DELETE /v1/webhooks/{id}`, `POST /v1/webhooks/{id}/test` — bearer parity with the dashboard.
- [Self-host](https://getinboxr.app/llms-full.txt#self-host): full stack on your own Docker / Proxmox / k8s. `docker pull jassra/inboxr-cloud:latest`. License required for commercial use; free for personal + evaluation.
- [AI agents](https://getinboxr.app/llms-full.txt#ai-agents): MCP install for Claude Desktop / Cursor / Claude Code, and reference patterns for email + SMS OTP + voice IVR flows.

## Machine-readable surfaces

- [OpenAPI 3.1 spec](https://getinboxr.app/openapi.json) — every /v1 endpoint (email, SMS, voice), parameter shapes, responses.
- [Full docs as one markdown file](https://getinboxr.app/llms-full.txt) — paste-into-context-window friendly.
- [MCP discovery manifest](https://getinboxr.app/.well-known/mcp.json) — install snippet, transport, full 22-tool catalogue (email + SMS + voice) with JSON Schemas.
- [MCP package on npm](https://www.npmjs.com/package/@jassra25/inboxr-mcp) — `npx -y @jassra25/inboxr-mcp` over stdio.
- [Sitemap](https://getinboxr.app/sitemap.xml) · [robots](https://getinboxr.app/robots.txt) · [security.txt](https://getinboxr.app/.well-known/security.txt).

## MCP for agents

Drop this into Claude Desktop / Cursor / Claude Code config:

```json
{
  "mcpServers": {
    "inboxr": {
      "command": "npx",
      "args": ["-y", "@jassra25/inboxr-mcp"],
      "env": {
        "INBOXR_API_KEY": "inb_live_...",
        "INBOXR_API_URL": "https://api.getinboxr.app"
      }
    }
  }
}
```

Tools the agent gets:

Email — `create_inbox`, `list_inboxes`, `delete_inbox`,
`wait_for_message`, `get_messages`, `get_message`, `extract_otp`,
`extract_link`.

SMS — `sms_create_inbox`, `sms_list_inboxes`, `sms_delete_inbox`,
`sms_send`, `sms_claim_sender` (stake the route for an expected sender),
`sms_wait_for_message`, `sms_get_messages`, `sms_extract_otp`.

Voice — `voice_list_flows`, `voice_create_flow` (raw JSON tree),
`voice_create_flow_from_description` (Claude writes the JSON for you),
`voice_assign_flow` (attach a flow to an inbox so inbound calls run it),
`voice_test_flow` (dry-run with simulated DTMF), `voice_list_traces`
(see how recent calls traversed the flow), `voice_list_voices` +
`voice_tts_generate` (catalogue + pre-rendered audio URLs).

Webhooks — `list_webhooks`, `create_webhook` (signing secret returned
once), `delete_webhook`, `test_webhook` (live receiver echo),
`webhook_deliveries` (last 50 attempts).

Forwards (mail aliases A → B) — `list_forwards`, `create_forward`,
`delete_forward`. Requires the `forward:write` scope, which is NOT
auto-granted by coarse `write` — explicit by design.

Workspace — `sms_credit_balance` (balance + packs), `list_domains`
(public + platform + custom), `inbox_smtp_credentials` (STARTTLS creds
for an inbox, returned once).

## Optional

- [Marketing site](https://getinboxr.app) — pricing, features, comparisons.
- [Status](https://getinboxr.app/status) — uptime + incidents.
- [Changelog](https://getinboxr.app/changelog).