Your inbox.
A few lines of code.

Start with an API key

Every request uses an enabled key created by the site administrator.

curl "https://yourdomain.com/api/domains/YOUR_API_KEY"

Gmail, Outlook & Hotmail — same API

The administrator connects each mailbox in Connected Accounts using OAuth, a Google App Password, or a compatible Microsoft Graph refresh token. App Password connections require PHP IMAP on the host. Keep your existing API key and the same endpoints. Replace the email with the connected address, or one of its aliases (you+tag@gmail.com, or a Gmail dot variant such as y.ou@gmail.com) to get only mail sent to that alias:

GET /api/email/you%40gmail.com/YOUR_API_KEY
GET /api/messages/you%40gmail.com/YOUR_API_KEY

The email endpoint returns the same email object; the messages endpoint returns the same message array shown below. A connected inbox that needs reconnection still returns its cached mail with HTTP 200 and X-NiloyFlix-Sync-Status: reconnect. Unconnected provider addresses are rejected. Provider domains are not added to the domain list, and this API cannot create Gmail or Microsoft accounts.

Provider Inbox messages import in batches of up to 10. The first request may return only the first batch; subsequent reads continue importing older messages and checking new mail. Automatic sync has a 30-second cooldown. The administrator can also schedule the included CLI sync. New-message checks alternate with history pages; this is not a real-time push service.

Only Inbox is fetched from the provider; Sent, Junk/Spam, Trash and attachments are not imported. Imported copies remain in NiloyFlix until locally deleted or disconnected, even if the provider later archives or deletes the original. Existing local domain inbox behavior is unchanged.

DELETE on a connected message removes only its NiloyFlix copy. It does not delete provider mail, and subsequent sync does not restore that local deletion. Disconnect stops API access and clears imported copies and saved connection tokens. A response header, X-NiloyFlix-Last-Sync, reports the last completed sync batch. When the cache is full, existing messages remain readable with HTTP 200 and X-NiloyFlix-Sync-Status: quota; new imports pause until space is freed.

List domains

Returns all configured domains available to the administrator API. Domains hidden from public signup remain available for existing inbox access.

["mail.example.com", "inbox.example.com"]

Create or validate an inbox

Trims whitespace, lowercases the address and validates the configured domain. Repeating this request returns the same address. Existing passwords and messages remain unchanged.

{"email": "demo@mail.example.com"}

This endpoint creates a permanent receiving inbox without a web password. Create an account through the website, or use the existing v1 mailbox endpoint, if you need password login. Administrator keys may provision hidden domains; public signup cannot.

Fetch messages

Returns a JSON array ordered newest first, including Inbox and Spam. An empty or uncreated valid inbox returns [].

[
  {
    "id": "64-character-hexadecimal-message-id",
    "subject": "Welcome to your inbox",
    "timestamp": "2026-10-18T12:30:08.000000Z",
    "date": "18 Oct 2026 12:30 PM",
    "datediff": "8 seconds ago",
    "content": "<p>Your inbox is ready.</p>",
    "sender_name": "Example Team",
    "sender_email": "hello@example.com",
    "attachments": []
  }
]

Keep your messages. Delete when you choose.

Inboxes no longer expire after 24 hours, and the previous 100-message deletion rule is removed. Each mailbox has 40 MiB (41,943,040 bytes) for stored text and HTML. When storage is full, new mail is rejected; existing mail is preserved. Raw incoming messages may be up to 10 MiB. Stored text and HTML are limited to 100 KB and 500 KB per message respectively; attachments are not retained.

Messages have no automatic expiry. You can permanently delete an individual message in the web inbox or with the endpoint below. A successful deletion frees its stored text and HTML space. Any enabled key can read (GET) or delete any message by ID; account deletion remains disabled.

{"deleted": true}

Response codes

Existing v1 integrations

The /api/v1 Bearer API keeps its paginated response format (limit up to 1000), but no longer has per-client ownership: any enabled key can read any inbox by ?email=, including connected inboxes and their aliases, and any message by ID. Creating an address that already exists returns it (200, "existing": true) instead of 409. Mailboxes have no automatic expiry. Individual messages can be deleted; account deletion remains disabled.