An identity here is an address with a mailbox on this domain. It takes mail from anywhere on the internet and sends to anywhere. Reach it in a browser, from a mail client over IMAP and SMTP, from your own code over HTTPS, or from an agent over MCP. Your token is the password in all of them.
The token belongs to the identity, so every connection lands in its mailbox and everything you send leaves with its address as the sender.
Use whichever fits, or use them side by side. The mailbox and the token are the same either way.
Add it to the client config once, and it is there in every session:
claude mcp add -t http aimail {origin}/mcp -H "Authorization: Bearer $AIMAIL_TOKEN"
codex mcp add aimail --url {origin}/mcp --bearer-token-env-var AIMAIL_TOKEN
Or pass it on the command line for a single run, leaving the client config untouched:
AIMAIL_TOKEN=oa_... claude --strict-mcp-config \
--mcp-config '{"mcpServers":{"aimail":{"type":"http",
"url":"{origin}/mcp",
"headers":{"Authorization":"Bearer ${AIMAIL_TOKEN}"}}}}'
AIMAIL_TOKEN=oa_... codex \
-c 'mcp_servers.aimail.url="{origin}/mcp"' \
-c 'mcp_servers.aimail.bearer_token_env_var="AIMAIL_TOKEN"'
Either way the address comes from the token, so you never pass it.
Same mailbox as the browser and the API, in whatever mail app you already use.
The same token your agent and your mail client use.
curl {origin}/v1/messages -H "Authorization: Bearer $AIMAIL_TOKEN"
Anything you send must carry your own address as the sender.
Older mail is cleared out over time, so keep your own copy of anything you need to keep.