# How do I give an AI agent its own email address?

*2026-10-21 · By Naol Ketema, founder of Agent Identity*

**Short answer:** Create a mailbox that belongs to the agent itself, not to a person, and give the agent a credential that can only act as that mailbox. With Agent Identity, creating an agent provisions its mailbox in the same API call, so the address comes back immediately and can send, receive, and thread replies. Your running agent then holds a key scoped to that one agent.

## What an agent email address actually needs

An agent email address is a mailbox that a piece of software owns and operates: it sends as itself, receives replies, and keeps conversations threaded. A forwarding alias or a send-only API key is not the same thing. If the agent cannot read the reply, it cannot hold a conversation.

In practice the agent needs five things:

- A real address that other mail servers will deliver to, with an MX record pointing somewhere that accepts mail for it.
- Outbound sending from that address, signed so receiving servers trust it (SPF, DKIM, DMARC).
- Inbound handling that turns a raw message into something the agent can read, with the attachments extracted.
- Threading, so a reply lands in the same conversation as the message it answers.
- A credential that can act as this mailbox and nothing else, so a compromised or confused agent cannot read other inboxes.

## Why not just use a Gmail account?

You can, for one agent, for a while. A consumer mailbox is built for a person in a browser. The agent ends up holding an OAuth token with broad access, you poll IMAP or a list endpoint to find new mail, and you write your own threading and deduplication. Scaling to many agents means many accounts, each set up by hand.

Building on a transactional sending API has the opposite problem: sending is easy, but receiving, threading and per-agent credentials are left to you. That is fine if you only ever send notifications. It is a lot of work if the agent has to read and answer replies.

## The steps, in general

- Step 1: Pick the domain. Use a shared service domain to start, or your own domain (ideally a subdomain such as agents.yourcompany.com) when the address is customer-facing.
- Step 2: Create the mailbox and tie it to an identity for the agent, with a handle and a display name.
- Step 3: Issue a credential scoped to that one mailbox and give only that credential to the running agent.
- Step 4: Send a first message and confirm delivery from a delivery event, not from the API's acceptance response.
- Step 5: Wire up receiving so the agent wakes when a reply arrives, instead of polling.

## How to do it with Agent Identity

In Agent Identity, an agent is a first-class identity with a handle, a display name and a mailbox. The mailbox is not a separate resource. Creating the agent provisions it in the same call, and the address is derived from the handle and the sending domain. It can receive mail as soon as the agent exists.

```ts
import { AgentClient } from "@agentidentity/sdk";

const admin = new AgentClient({
  baseUrl: "https://api.agent-identity.dev",
  apiKey: process.env.AID_KEY!, // org key
});

const agent = await admin.identities.create({
  handle: "support-agent",
  displayName: "Support Agent",
});
console.log(agent.mailboxAddress); // support-agent@…

// A key that can only act as this one agent. Give this to the running process.
const { key } = await admin.apiKeys.create({ name: "support-agent runtime", identityId: agent.id });

const asAgent = new AgentClient({ baseUrl: "https://api.agent-identity.dev", apiKey: key });

const message = await asAgent.mail.send({
  identityId: agent.id,
  to: ["you@example.com"],
  subject: "Hello",
  text: "First message.",
  idempotencyKey: "first-message",
});
console.log(message.status); // "queued", then "sent", then "delivered"
```

There is no from field on a send. The message goes out from the agent's own address, which is the point. The send resolves when the message is accepted (HTTP 202), not when it is delivered; delivery shows up later as a mail.delivered, mail.bounced or mail.complained event.

To put the mailbox on your own domain, verify the domain first and pass it when you create the agent: { handle: "jobs", displayName: "Jobs", domain: "acme.dev" } gives jobs@acme.dev. The custom domain guide covers the DNS side.

## Org keys versus agent keys

The key you get at signup is an org key. It administers the whole organization: creating agents, suspending them, adding domains. Do not hand it to a running agent. An agent key is created with an identityId and acts as that one agent only. Another agent's mailbox returns 404 to it, its events and webhooks are limited to its own, and it cannot create agents or API keys.

This split is what makes one address per agent safe. If an agent misbehaves, suspend it with the org key. Suspension stops sending and receiving without losing history, and it records a reason. There is no delete; suspend and reinstate are the intended controls.

## Limits worth knowing before you start

- Until the organization owner verifies their email with a six-digit code, the organization can only email that owner, and only a few times a day.
- Sends count against a daily quota per organization. Going over returns 429 with the code mail.outbound_quota_exceeded and a Retry-After header.
- The number of agents, emails a day and mail storage depend on the plan. client.usage() reports where you stand.
- Email is on every plan, including Free. Builder is $19 a month and Team is $149 a month.

If your agent only ever sends one-way notifications and never reads a reply, a plain transactional sending API is enough and you may not need a per-agent mailbox at all. The value of a real agent address shows up when the agent has conversations.

## FAQ

### Can an AI agent have a real email address that receives mail?

Yes. In Agent Identity every agent's mailbox receives mail as soon as the agent is created, and each inbound message is threaded, stored and appended to the event log as mail.received.

### Do I need my own domain to give an agent an email address?

No. An agent gets an address on the service's mail domain by default. You can verify your own domain and create agents on it when the address needs to carry your brand.

### Can I change an agent's email address later?

The handle and mailbox address stay the same when you rename an agent; only the display name changes. For a different address, create a new agent.

### How do I stop an agent from sending email?

Suspend it with an org key and a stated reason. Suspension stops sending and receiving, keeps the history, and can be reversed with reinstate.

---
Docs: https://www.agent-identity.dev/docs · All guides: https://www.agent-identity.dev/guides · llms.txt: https://www.agent-identity.dev/llms.txt