Concepts
Projects, inboxes, API keys and since: the four ideas every Receiver.email client is built on.
In One Paragraph
A project owns mail and API keys. An inbox is any address under the project's suffix. An API key can mint inboxes and read the project's mail. Waiting for mail always means "the first email received strictly after since". The REST API, SDKs, MCP server and CLI all follow these rules, so the same call gives the same answer from each.
Organizations
An organization is the top-level entity. It represents your company or team and is the unit of billing. When you first sign up, a default organization is created for you automatically.
Members
Multiple members with roles: admin, member, or viewer.
Billing
Usage quotas and subscription tier managed at the org level.
Usage Resets
Email and API request counts reset on the first of each month.
Projects
A project belongs to an organization and is the isolation boundary: its mail, addresses and API keys are its own. Use one per test suite, per agent or per team.
Email Addresses
Each project is assigned an 8-character identifier like a3kx9p2m. Emails sent to any address ending in [email protected] are captured.
Isolation
Projects are fully isolated. Emails, API keys, and settings are not shared between projects.
Use Cases
One project per test suite, agent, environment (staging or CI) or team, so nothing reads mail meant for something else.
Inboxes
An inbox is any address under a project: {prefix}{emailSuffix}. Inboxes are unlimited and need no setup, and nothing is stored until mail arrives.
Mint addresses with inboxes.create() in the SDKs, create_inbox in the MCP server, receiver inbox new in the CLI or POST /projects/:id/inboxes. It adds a random suffix so parallel callers never collide, and returns createdAt, the time to wait from. Building an address by hand works too: take the project's emailSuffix and put any prefix in front, never hard-code the domain part.
Emails
An email represents a captured inbound message. When an email arrives, Receiver.email parses it and stores:
| Field | Description |
|---|---|
| Metadata | Sender, recipient(s), subject, date received |
| Body | Plain text, HTML, and raw RFC822 format |
| Headers | All email headers |
| Links | All URLs extracted from HTML and text body, automatically |
| Attachments | File name, MIME type, size. Downloadable via API |
Emails are indexed in under 2 seconds and available via the API immediately. They are retained for the duration specified by your plan (7 to 365 days) and then automatically deleted.
API Keys
API keys start with recv_live_ and belong to one project. They are separate from your dashboard login, and the key alone is enough: clients find its project with GET /whoami.
A key can
Read its project, mint addresses, wait for, read and delete mail, and send a test email to its own project.
A key cannot
Create keys, manage webhooks or delete the project. Those need a dashboard session, so a leaked key cannot widen its own access.
- Create one key per pipeline or agent, so you can revoke one without the others.
- Keys can have an optional expiration date.
- Revoked keys stop working immediately.
Security Note
Store API keys as environment variables (e.g. RECEIVER_API_KEY) in your CI/CD provider. Never commit them to source control.
Since
since is an ISO 8601 timestamp. A wait (waitFor, waitForOtp, wait_for_email, receiver wait) matches only mail whose receivedAt is strictly after it.
- First email on a new address: use the inbox's
createdAt. Nothing from before the address existed can match. - The next email (after "Resend code", or the second step of a flow): use the
receivedAtof the email you already have. - Omitted: the last 60 seconds, so an email that arrived just before the call still counts.
A wait that times out is a normal result (status: "timeout" in the API, ReceiverTimeoutError in the SDKs, exit code 2 in the CLI). Waiting again with the same since never misses an email that arrived in between.
Email Lifecycle
- Your application sends an email to one of your project's addresses.
- The email is received and stored as raw data within milliseconds.
- An async worker parses the email: extracts metadata, body, links, and attachments.
- The parsed email is indexed and available via the API (typically under 2 seconds end-to-end).
- Your test or agent gets it by waiting (long-polling), streaming, a webhook, or listing.
- After the retention period, the email and its attachments are automatically deleted.
Retention
Each plan has a retention period that determines how long emails are kept:
| Plan | Retention |
|---|---|
| Free | 7 days |
| Starter | 30 days |
| Pro | 90 days |
| Enterprise | Up to 365 days |
After the retention window, emails and their attachments are permanently deleted. This is automatic and cannot be undone.
Next Steps
- Quick Start: set up your first project
- Give your agent an inbox: inboxes through MCP
- TypeScript SDK: full SDK reference
- REST API Reference: all endpoints documented