# email59 > email59 is an email router for apps and AI agents: email in your app before you own a domain. One call to sign up, one call to send, mail goes out from @email59.com, so there are no DNS records, no account review and no SMTP server. Agents sign themselves up with an email code and can use the built-in MCP server. email59 routes each message to an established sending provider and adds unsubscribe links and lists, a blocklist, email validation and a free deep email check. 200 emails a day free, renewed every day; paid credits last until used, and there are no subscriptions. Base URL: https://email59.com/v1 Auth: `Authorization: Bearer `: an API key (`e59_live_...`, shown once) or a session key from email sign-in (`e59s_...`, 30 days) MCP: https://email59.com/v1/mcp (JSON-RPC over HTTP POST). Same sign-in via the `auth` tool. Function-calling schema: https://email59.com/v1/mcp/schema Unit: 1 email = 1 recipient. Free: 200 emails a day, renewed every day (UTC day). Unused free emails don't carry over. New accounts start at 50 free emails a day; the full 200 comes with one sign-in at https://email59.com/account.html, any credit purchase, or after 7 days with sends on 3 of them (GET /v1/account shows daily_limit). Free emails come from a shared monthly pool: if it runs out, sends answer 429 free_emails_paused until the next UTC month, and credits keep working. Credits: each $1 adds 3,636 email credits; checkout adds a purchase fee of 5% of the pack, at least $0.50; packs pack_5, pack_10, pack_50 (GET /v1/pricing has totals). Credits don't renew and last until used. A send uses today's free emails first, then credits. Sender: mail goes out from `@email59.com`. There is no domain to set up. A reply to that address reaches nobody, unless the name is a mailbox the account opened on the website (see Mailbox below). To get answers, give POST /v1/send (or MCP send_email) an optional `reply_to`: one address of your own, not at email59.com, on a domain that takes mail; it becomes the Reply-To header. Errors: 400 invalid_reply_to, 400 reply_to_must_not_use_email59_com, 422 reply_to_rejected. Campaigns refuse reply_to (400 reply_to_not_available_for_campaigns). A name that is somebody else's mailbox is refused as a sender (403 from_is_a_mailbox), and so is a name that reads as email59 or its staff, such as admin, support, billing or security (403 from_is_reserved); use your app's name, e.g. yourapp or yourapp-support. Names are letters and digits with single dots, dashes, underscores or a plus between them (400 invalid_from otherwise). ## Steps for an agent 1. Sign up or sign in: POST /v1/auth with {"email": "..."}; a 6-digit code is emailed. Then POST /v1/auth with {"email": "...", "otp": "123456"} to get a session_key (a new email is signed up). Send it as `Authorization: Bearer `. Make a long-lived API key with POST /v1/keys. Got an invite code? POST /v1/invites/accept {"code": "E59-..."} adds its email credits (one invite per account; GET /v1/invites/{code} shows what it adds). 2. One recipient, transactional only (marketing is closed, see "Sending rules" below): POST /v1/send with {"from": "hello", "to": "user@example.com", "subject": "...", "text": "..."}. `from` is optional; the domain is always email59.com. `category`: "transactional" (default) or "marketing" (same key; marketing always has the unsubscribe link, skips role addresses and people who unsubscribed; optional `list_id`). Every email goes out as HTML in a template with a text part: `template` basic (default), code (give `code`), notice (`heading`, `button_text`, `button_url`), report (wide tables) or letter (personal); `preheader`; `brand` {name, color, logo_url, url, address} for one email, or set it once with PATCH /v1/account {"brand": {...}}. Docs: https://email59.com/docs.html#templates 2a. Supabase auth emails: POST /v1/hooks/supabase with {"secret": "v1,whsec_... (from Supabase Authentication > Hooks > Send Email Hook)", "supabase_url": "https://.supabase.co", "app_name": "Acme", "from": "auth"} returns a `url`; paste it as the Send Email Hook (HTTPS) in Supabase. Calls are checked with the Standard Webhooks signature and answered within 5 seconds. Docs: https://email59.com/docs.html#supabase 2b. Verification codes (Verify API): POST /v1/verify/start with {"to": "user@example.com", "app_name": "Acme"} emails a one-time code (6 digits by default, code_length 4-10; expires_in 60-3600 seconds, default 600) and returns an id; the code is never returned. Then POST /v1/verify/check with {"to": "user@example.com", "code": ""} (or {"id": ..., "code": ...}) always answers 200 with valid true/false and status approved, wrong_code, expired, too_many_attempts (5 wrong codes lock it), already_used, replaced (a newer code went to that address) or not_found. A right code works once. One code per address every 30 seconds, 5 an hour (429 too_soon / too_many_codes with retry_after_seconds). Each code sent counts as one email of the allowance; checks are free. Docs and a Next.js/Supabase example: https://email59.com/docs.html#verify. Test page: https://email59.com/verify.html 3. CLOSED: POST /v1/campaigns (and MCP send_campaign) answer 403 marketing_not_allowed. email59 does not carry marketing email. Old notes: One marketing email to many (up to 1000 recipients): POST /v1/campaigns with {"from": "news", "subject": "...", "html": "...", "list_id": "news", "recipients": ["user@example.com"]}, optional `template` (basic, notice, letter), `heading`, `preheader`, button and `brand`. The campaign provider adds the unsubscribe link and handles opt-outs. 4. GET /v1/account for today's numbers (daily_limit, sent_today, remaining_today, credits_remaining; credits_expire and credits_renew are always false). Buy credits with POST /v1/orders {"pack_id": "pack_10", "agree": true, "policy_version": ""} after the person has read and agreed to the refund policy and terms at GET /v1/policy (one-time payments, no subscription, not refundable in general): it returns a checkout_url for a person to pay; the credits are added once the payment clears. 5. POST /v1/validate with {"email": "..."} before adding a recipient. Verdicts: ok, invalid, no_mx, disposable, role (role addresses are not used for campaigns). 4b. Test keys for staging and CI: POST /v1/keys with {"label": "ci", "mode": "test"} returns an `e59_test_...` key. POST /v1/send, /v1/campaigns and /v1/verify/start with it are checked like real sends, stored and never delivered (answer has "status": "test", "delivered": false) and use no allowance. Read them: GET /v1/test/messages (optional ?to=), GET /v1/test/messages/{id} (html, text; a verify code is in the stored subject), DELETE /v1/test/messages. Newest 100 kept for 7 days; 2,000 test emails per 24 hours. A test key can't make keys, buy, edit lists or be swapped for a session key (403 test_key_not_allowed). Docs: https://email59.com/docs.html#test-keys 5a. Free deep check, no key: GET /v1/check?email=... (or the check_email MCP tool). Format, provider username rules, disposable and role addresses, and the domain's MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI records, with a score 0-99 and a verdict (likely_valid, risky, likely_invalid, unknown). Gmail, Outlook and other big providers skip DNS. No email is sent, so the score is an estimate. 100 a day per IP, 1,000 a day per account with a key. Page: https://email59.com/check.html 5c. List check (Bearer key): POST /v1/check/bulk with {"emails":[...]} or {"csv":""} (or the check_list MCP tool), up to 1,000 different addresses a call. One status each: valid, risky, role, disposable, no_mx or invalid, with a reason, plus counts. Format, provider rules and one MX lookup per domain; no email is sent. 2,000 addresses a day per account, 20,000 once it has bought credits; a list over what is left today is refused whole (429 daily_list_check_limit). People: the account page takes a CSV file. Docs: https://email59.com/docs.html#list-check 5b. Free link scanner test, no key: POST /v1/linktest returns a `link` and a `view_key`. Email the link to the mailbox you want to test; every request to it is recorded (time, GET/HEAD/POST, IP, network owner, user agent). The page the link opens has one button; pressing it (POST) marks the human click. GET /v1/linktest/{id} with header X-View-Key returns the hits and a summary (automated_before_your_click). 20 test links a day per IP; records are deleted after 7 days. Page: https://email59.com/tools/link-scanner-test.html. More tools (sign-in code guess odds calculator; dev mail fence: a send wrapper in Python, JavaScript, PHP, C# or Go that only delivers when MAIL_MODE is allowlist or live, https://email59.com/tools/mail-fence.html; bounce reader: paste an SMTP bounce line such as 550 5.1.1 and see temporary or permanent, about the address or about the sender, and whether to wait, stop or fix, https://email59.com/tools/bounce-reader.html; plain-text twin: paste an email's HTML, get a draft of its text/plain part with links written out, and see whether every link, code and amount in the HTML is also in the text, https://email59.com/tools/plain-text-twin.html; email typo catcher: type an address or paste a list and see which domains are one slip from a well-known provider (gamil.com, gmail.con) with the "Did you mean" suggestion, https://email59.com/tools/email-typo-catcher.html; same mailbox finder: paste a list of sign-ups and see which addresses reach the same mailbox (Gmail dots, plus tags, googlemail.com, capitals folded), with a comparison key for each, https://email59.com/tools/same-mailbox-finder.html; new address checklist: moving from an old Gmail to a business address, tick the accounts you have (bank, tax, domain, app stores, suppliers) and get a printable list ordered by risk with a date for each change, saved in the browser, https://email59.com/tools/new-address-checklist.html; Gmail POP-ending helper: Gmail on the web stops "Check mail from other accounts" (POP) and Gmailify in January 2027; enter a business address and how it is read today, the page runs the deep check on its domain (MX, SPF, DMARC, no email sent) and picks forward (only when the host rewrites senders or DMARC allows it), the Gmail phone app over IMAP (server name from the MX), a one-time copy of old mail or an email59 mailbox, with a dated checklist (print, CSV), https://email59.com/tools/gmail-pop-ending.html; DMARC digest: sign in on the website, get dmarc.@email59.com (one of your mailboxes) for the rua= tag of your DMARC record, and read summaries of the aggregate reports (senders, pass rate, what to fix) plus an optional weekly email, https://email59.com/tools/dmarc-digest.html, website only, no API yet): https://email59.com/tools/ 6. POST /v1/blocklist and POST /v1/unsubscribes to manage recipients. Blocked, invalid or unsubscribed recipients are refused or skipped and don't count against the allowance. 7. CLOSED: POST /v1/optin answers 403 marketing_not_allowed (marketing mail is closed). Old notes: Marketing consent: PATCH /v1/account {"require_consent": true} sends marketing (/v1/send category marketing, /v1/campaigns) only to confirmed opt-ins; others get verdict no_consent. POST /v1/optin {"email","list_id","wording"} emails a confirmation link (double opt-in; the press on its page is the consent, kept with wording, time and /24 network); GET /v1/optins?email= lists them. Optional consent_key (a policies.biz59.net project's pol_ck_...) records opt-ins and unsubscribes there too (purpose marketing_email) and counts consent given there. Docs: https://email59.com/docs.html#consent ## Sending rules (every account) No email sent through email59 is marketing, and email from a kid-safe address is kid-safe too. - Sending is never marketing: marketing wording (discount codes, "buy now", "limited time offer") is refused: 422 content_not_allowed, reasons ["marketing"], phrases in `marketing`; /v1/campaigns, category "marketing", MCP send_campaign and /v1/optin answer 403 marketing_not_allowed. - From a kid-safe address (a mailbox opened as kid-safe): bad language or sexual content is refused (reason not_kid_safe, `words` = how many), and so is text not in English (reason not_english, `passages` = how many). Mailbox compose checks it for that mailbox; /v1/send checks it when `from` is the caller's own kid-safe mailbox. Other addresses send their text as written. - Mail that reaches a kid-safe address is cleaned on the way in (bad language, sexual content, other languages removed) and its attachments are checked before they can be opened. - Every email sent or received is read by an automated AI check. A sent email that breaks the rules puts the account's sending on hold: 403 sending_on_hold (contact support@email59.com). - Mail from outside accounts added in the email59 app is filtered the same way. Mail to normal addresses is stored as sent. - Applies to /v1/send, MCP send_email, the Supabase hook and mailbox compose. A refused send uses no allowance. Body: {"detail": {"error": "content_not_allowed", "reasons": [...], "words": n, "passages": n, "marketing": [...], "message": "..."}}. ## Kid-safe addresses (an option per mailbox) - https://email59.com/kid-safe-email: when adding an address the account chooses Normal or Kid-safe. Normal addresses get their mail as sent. A kid-safe address has its own monthly subscription (price: https://email59.com/pricing.html#kid-safe), separate from other plans; it takes mail once the first payment goes through. It is read by two people: the account that opened it (in its mailbox) and a kid who signs in at https://email59.com/kid.html with the address and a password the account sets; the kid's page shows only that mailbox (Inbox, Sent, Trash; read, write, reply), no plans, payments or settings. When payment stops the address stays filtered and keeps taking mail for the account; the kid's sign-in pauses. Every email that reaches a kid-safe address is cleaned on the way in, before anyone reads it, and only the cleaned copy is stored; an automated AI check then removes passages not for a child, or keeps an email from the kid's page (the account still sees it). 1) Swear words, sexual words and explicit wording (also with look-alike characters, masks like f*ck or spaced letters, and sexual emoji) become [removed], in the subject and body. 2) Text not in English (another alphabet, or a sentence that reads as another language) becomes [removed: not English]; names, numbers, addresses and links stay. 3) Attachments are held ("being checked", not downloadable) until checked: clean ones are released after a short delay; files that can't be read (encrypted, archives, programs, over 4 MB, unknown types) or aren't clean are deleted. 4) A note line at the top of the email counts what was removed, and each deleted file is named ("Removed: report.zip (could not be read)"). Mail from an IMAP or POP account added to email59 (the email59 app) is read, filtered and, where needed, deleted the same way, so don't add an account you don't want processed. DMARC report mailboxes are not filtered. ## Gmail cleanup (for people, in the browser) - https://email59.com/mailbox.html: a signed-in person picks an address at email59.com and gets an inbox on that page: Inbox, Sent, Spam and Trash with search, HTML mail with its pictures, attachments that open on the page or download, replies and new mail in plain text from the same address. The owner sets the name people see (a name only: first, middle and last name in letters, no commas, digits, titles or web addresses) and a short plain-text signature, and can change both at any time. Only mail that arrives after the address was opened is shown. Emails are kept in email59's database; attachments and pictures are compressed files only the owner can open. Trash and Spam are emptied after 30 days. Every account includes 2 mailboxes with 5 GB each; more is a subscription a person starts and cancels on the website. There is no API or MCP tool for mailboxes yet: website sign-in only. Terms: https://email59.com/terms.html - https://email59.com/gmail-cleanup.html: a signed-in person connects their own Gmail mailbox (Google app password), email59 reviews the metadata of every email (date, sender, subject, read/starred/important, labels, Gmail's section, size; never a body or an attachment) and suggests what is safe to delete: social network notifications, Amazon notices and no-reply mail older than 30 days, plus Gmail's own sections (Promotions, Social, Updates, Forums, Purchases, mailing lists, Spam). Picked groups are moved to Gmail's Trash (kept 30 days by Gmail); starred mail is never moved. The review can be deleted from email59 at any time and is deleted after 7 days. Optional auto-clean is a subscription a person starts and cancels on the website: it looks at up to 3 Gmail accounts every hour and moves new spam and the chosen sections to Trash. There is no API or MCP tool for Gmail cleanup: it works only with a website sign-in. Terms: https://email59.com/terms.html - https://email59.com/app: the email59 mobile mail app ("email like you chat"). Android: download the APK straight from https://email59.com/download/email59-1.0.0.apk (version 1.0.0, Android 7.0 or later, no Play Store needed; the page shows how to allow the install and the file's SHA-256). iPhone comes next. It reads Zoho Mail, Amazon WorkMail, Outlook / Microsoft 365, email59 mailboxes and any IMAP or POP mailbox in one feed, with unread counts, optional urgent-mail alerts the person turns on at setup, open and reply, swipe to delete, and reactions and "typing" between email59 app users. The page has an iPhone waitlist sign-up. ## Every email - Every email says it is a system generated email and that no replies will be received, except one sent with `reply_to`. - Unless the content already has an unsubscribe link, email59 adds one. Transactional links open GET /v1/unsubscribe/{token}, which names the recipient and the sender; one press (POST) unsubscribes that address from that sender's campaigns. - Marketing email from /v1/send has List-Unsubscribe and List-Unsubscribe-Post (one-click, RFC 8058) headers; the mail app's one-click POST unsubscribes at once. ## Account console (people) - Sign in at https://email59.com/account.html with osec.one. The console uses /v1/web/* (account, name, keys, orders) with the osec session as a Bearer token. Bots use the API key instead. ## MCP tools auth, get_pricing, check_email (no key needed); get_account, update_account, send_email, send_campaign, validate_email, block, unblock, list_blocklist, add_unsubscribe, buy_pack, order_status, create_api_key, list_api_keys, list_test_messages, verify_start, verify_check, check_list (Bearer key). Errors come back with isError true and the REST error code. ## Docs - Human docs and quickstart: https://email59.com/docs.html - Articles on email: https://email59.com/articles/ (including kid-safe email for families and schools: https://email59.com/articles/kid-safe-email-for-families-and-schools.html ; why email59 refuses marketing email: https://email59.com/articles/why-email59-refuses-marketing-email.html ; how an automated AI check reads every email: https://email59.com/articles/how-an-automated-ai-check-reads-every-email.html) - Free tools (most run in the browser): https://email59.com/tools/ , including a header reader that says whether SPF, DKIM and DMARC passed for the From domain: https://email59.com/tools/header-reader.html, and a tracking link maker for shipped emails (carrier link, text line and HTML button from a tracking number): https://email59.com/tools/tracking-link-maker.html, and a signature maker (four-line HTML email signature with a hosted logo and its plain-text version): https://email59.com/tools/signature-maker.html, and an out-of-office writer (the reply with the return date and one contact, a short version for strangers, Gmail and Outlook steps with the dates): https://email59.com/tools/out-of-office-writer.html, and a late payment interest calculator (UK and EU statutory interest and fixed sum on an overdue invoice, rate for the half-year, paste-in paragraph): https://email59.com/tools/late-payment-interest.html, and a price-change notice planner (the day to email each subscriber before a price rise, California, New York, UK and EU windows, reminder, CSV): https://email59.com/tools/price-change-planner.html - OpenAPI reference: https://email59.com/v1/docs - Pricing (JSON): https://email59.com/v1/pricing ## Notes - Errors use HTTP status codes (400, 401, 403 marketing_not_allowed / sending_on_hold, 409, 422 recipient rejected or content_not_allowed, 429, 502, 503). - Company: Biz59 LLC, New York, NY.