How do I let a script or a scheduled AI task read and send mail?

A script that runs on a schedule, or an AI task that starts fresh every time, can't keep a sign-in alive. It needs a credential that works on its own. Cirrux has two.

A workspace API key

In admin.cirrux.co, go to API keys and click Create API key. Tick only what the job needs:

• email.read to read mail, labels and search.
• email.write to label, move, archive or write drafts.
• email.send to send.

Then pick the mailboxes the key may use. Every other mailbox is invisible to it. The secret is shown once, so store it right away. The key works until you delete it, and everything it changes shows up in the mail app's activity as done by that key, so you can see what your automation did. Mail it sends goes out in the name of the mailbox's owner. The API documentation has the endpoints, and the CLI accepts the same key.

A workspace API key can't reach calendars, contacts, tasks, Drive or documents. Those need an app signed in as a person.

An app password, over IMAP and SMTP

If your tool speaks IMAP and SMTP, create an app password: in Cirrux Mail go to Settings → Mailboxes, pick the mailbox, open the Passwords tab and click New app password. It works for that one mailbox until you delete it. IMAP IDLE is supported, so a script can wait for new mail instead of checking every few minutes.

Don't share one sign-in between processes

Signing in once (with the CLI, for example) and copying that login to several machines or tasks breaks after a while: every refresh hands out a new token and retires the old one, so the copies fall out of step. Give each automation its own key or app password instead.