✦ AUTONOMOUS ONBOARDING

Discover. Authenticate. Operate.

Every capability is self-describing and machine-parseable. An agent reads /llms.txt, establishes identity, and operates its inbox end-to-end — no human signup, every call authenticated.

Establish identityPOST /identity/create — the agent receives an identity token

Provision an inboxPOST /inbox — returns scoped read / write / admin tokens, tenant-isolated

Receive & extractGET /inbox/{id}/messages — authenticated reads; OTP codes and magic links pre-extracted

Send, governedPOST /outbound/{id}/send — rate-limited, audited outbound with emergency shutdown

agent@autonomous ~ courier v3 (tokens are placeholders)

# establish an agent identity
$ curl -X POST https://getcourier.dev/identity/create \
    -d '{"agent":"agent-op-01"}'
{"identity":"agt_…","token":"<identity-token>"}

# provision an inbox (authenticated)
$ curl -X POST https://getcourier.dev/inbox \
    -H "Authorization: Bearer <identity-token>"
{"inbox_id":"ibx_…","address":"agent-op-01@inbox.getcourier.dev",
 "tokens":{"read":"…","write":"…","admin":"…"}}

# read messages with the inbox-scoped read token
$ curl -s https://getcourier.dev/inbox/ibx_…/messages \
    -H "Authorization: Bearer <read-token>" | jq .messages[0].codes
["832947"]

# continue workflow ✓

✦ PROTOCOL SURFACE

Every endpoint, machine-first

Structured JSON errors with retry semantics. Rate-limit headers. Exponential backoff guidance. Every read and write authenticated and tenant-isolated. Built for unattended operation.

POST/identity/create

Establish identity

Self-serve agent identity with no human signup. Returns the identity token that anchors all later calls.

POST/inbox

Provision a scoped inbox

Authenticated provisioning. Returns inbox-scoped read, write, and admin tokens. Tenant-isolated by design.

GET/inbox/{id}/messages

Retrieve & extract

Authenticated, inbox-scoped reads. Verification codes, magic links, and expiry URLs extracted automatically.

POST/outbound/{id}/send

Send, governed

Outbound email under policy: rate limits, immutable audit logs, and emergency shutdown controls.

GET/providers/status

Provider abstraction

Delivery rail status — requires auth (reserved for agent use). Resend, SMTP, SES, or Postmark can carry mail — Courier owns identity, routing, and governance.

GET/capabilities

Discover the protocol

Pricing, limits, error formats, retry semantics, and onboarding flow — fully self-describing.

✦ PRICING

Machine-payable tiers

Free to evaluate. Paid tiers settle over Lightning Network using x402 semantics — your agent requests an invoice and pays it. No card on file, ever.

Tier	Cost	Inboxes	Ingests / mo	Workflows	Payment
Free	$0	10	500	50	—
Hobby	5K sats/mo	100	10K	500	Lightning
Agent	25K sats/mo	1,000	100K	5K	Lightning
Autonomous	100K sats/mo	Unlimited	Unlimited	Unlimited	Lightning

x402 protocol · HTTP 402 Payment Required · invoice at POST /x402/invoice · experimental

✦ V3 ZERO TRUST

Security-first by architecture

Engineered for agents that can't file a support ticket — and for the security teams accountable for them.

Zero Trust APINo implicit trust. Every request carries an identity or inbox-scoped token.

Inbox-scoped tokensSeparate read, write, and admin tokens per inbox. Least privilege by default.

Tenant isolationOne agent's inbox is invisible to every other agent. No global listing endpoints.

Immutable audit logsEvery provisioning, read, and send is recorded and tamper-evident.

Rate limitsPer-identity and per-inbox limits with Retry-After headers and backoff guidance.

CISO controlsOperator-level policy: allowed domains, send quotas, token revocation.

Emergency shutdownOutbound can be halted instantly — per inbox, per identity, or globally.

Provider abstractionResend, SMTP, SES, or Postmark as delivery rails. Courier owns identity, routing, audit, governance, and agent workflow.

✦ OUTBOUND (ALPHA)

Governed sending to the real internet

Courier outbound is in ALPHA and is operator-gated. It requires Resend domain verification and explicit provider configuration. Every send is identity-tracked, policy-enforced, and audited. Agents should check /capabilities for current status before assuming outbound is available.

GovernedAllowed domains, send quotas, and policies enforced per identity. No open relay.

Rate-limitedPer-identity and per-inbox limits with Retry-After headers and exponential backoff.

AuditedEvery send recorded in append-only JSONL audit stream. Tamper-evident.

Reputation-awareSender reputation tracked per identity. Abusive patterns trigger automatic suspension.

Provider-routedAutomated failover across Resend, SMTP, SES, or Postmark. Courier owns the identity layer.

CISO-controlledOperator-level policy: allowed domains, send quotas, token revocation, emergency shutdown.

✦ FRAMEWORK INTEGRATIONS

Drop into any agent stack

Courier speaks HTTP/JSON and exposes MCP tools. Works with every major agent framework out of the box.

Hermes Agenthermes config set tools.courier.enabled true — native MCP integration

OpenHandsDrop-in MCP server config. Full-duplex inbound + outbound for coding agents.

OpenAI Agents SDKUse Courier as an agent tool: create inboxes, receive OTPs, send replies. Python examples included.

Claude Desktop / CodeAutonomous onboarding script provisions identity, inbox, and tokens in one command.

CursorMCP server integration. Agents create inboxes, extract codes, and send replies from within the editor.

Python & Node.jspip install requests or npm install courier-protocol — full API access from any script.

Email infrastructure
for autonomous agents