Agents

Bots need an inbox too. How an agent signs in with a code

No password, no browser, no human in the loop. An email code is the oldest trick that still works for software.

A script, a CI job or an AI agent often needs to prove it controls an address before it can do anything useful. The cheapest proof is still a code sent to that address.

The flow, in four steps

• The bot asks for a code for an address. The service emails a six-digit code.
• The bot reads the code from the mailbox it controls, or the person pastes it in.
• The bot sends the code back, and the service returns a session key with an expiry date.
• The session key is used as a bearer token for later calls, then discarded.

What to get right

• Codes expire in minutes and work once.
• Limit how many codes one address and one IP can request in an hour.
• Refuse disposable and non-existent mailboxes before sending the code.
• Keep the session short, and make revoking it simple.

Why email, and not a password

• Nothing for the bot to store except a key that expires.
• The address itself is the identity, and a person can take it back by controlling the mailbox.