mailbridgeAPI
DEMOLog inConnect a mailbox
DATA PROTECTION

Encryption measures

Review the protections used for transport, provider tokens and locally stored integration credentials.

Transport security

Public production traffic uses HTTPS. SMTP and IMAP connections use the security mode configured for the mailbox and supported by its provider.

Provider tokens

Supported OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and private server-side encryption keys.

Application credentials

Account and mailbox API keys must remain in server-side environment variables or a secret manager. They grant mailbox operations and must be rotated after suspected exposure.

WordPress storage

The official plugin encrypts selected MailBridgeAPI credentials using key material derived from WordPress authentication salts. It does not copy the mailbox password to WordPress.

Operational boundary

Encryption reduces exposure; it does not replace access control, secure endpoints, key rotation, provider security or customer-side secret handling.

YOUR OWN MAILBOX. YOUR API KEYS. YOUR REQUESTS.

Connect your own mailbox to API keys, then control it through endpoints.

MailBridgeAPI links the SMTP and IMAP mailbox you own or are authorized to use to an account API key and a mailbox API key. Every request selects that same mailbox: send from its address, read its received messages, or process them in your applications.

Explore the docs
Your own mailboxapikey + apikeyboxAPI endpoint requestAction through that mailbox
POST /sendemail/

Send through your mailbox

A POST request uses the SMTP connection of the mailbox selected by apikeybox and sends from that mailbox.

GET /getemail/

Read your mailbox

A GET request uses the same mailbox key to retrieve messages from its configured IMAP folders.

YOUR LOGIC. YOUR WORKFLOW.

Use your mailbox data

Your authorized application handles the result in its workflows, automations, CRM, support tools, or AI systems.

Connect only a mailbox you own or are authorized to use. The provider must allow compatible SMTP or IMAP access, and its limits still apply.