Unsendbox logo
Get started
← Return to rootUpdated

Connect your AI tool to Unsendbox

Unsendbox exposes a Streamable HTTP MCP endpoint. OAuth-capable clients can discover the authorization flow automatically; custom clients can use an organization-bound API key when they support the x-api-key header.

Get your API key

Authentication options

Choose OAuth for a client that supports MCP authorization discovery. Use an API key only with a custom client that explicitly supports x-api-key.

OAuth
Supported MCP OAuth uses authorization code flow, S256 PKCE, and the advertised scopes: openid, profile, email, offline_access, read, write, mcp:read, mcp:write, and mcp:admin.
API key
Custom clients may send x-api-key. The key remains private, and an organization-bound key cannot be overridden by a conflicting organizationId query parameter.
Not a directory claim
The discovery contract is documented here. Anthropic directory listing or deployed-endpoint readiness is not implied by this page.

1) Use the MCP endpoint

Enter this Streamable HTTP endpoint in an MCP-capable client.

  1. 01MCP endpoint: https://app.unsendbox.com/api/v1/mcp
  2. 02Keep the endpoint URL unchanged when the client performs OAuth discovery.
  3. 03Keep API keys, OAuth client secrets, and authorization codes private.

2) Connect Claude Code with OAuth

Configure Claude Code with the HTTP MCP endpoint, then allow its OAuth flow to run.

  1. 01Run `claude mcp add --transport http unsendbox https://app.unsendbox.com/api/v1/mcp` to add the remote HTTP server.
  2. 02Use Claude Code OAuth for this endpoint. Do not add an API key or Authorization header to this server entry.
  3. 03On first connection, let Claude Code follow the protected-resource metadata link and complete authorization code flow with S256 PKCE.
  4. 04Claude Code owns its local loopback callback; do not enter a hosted callback URL manually.
  5. 05The protected-resource metadata URL is https://app.unsendbox.com/api/v1/mcp/.well-known/oauth-protected-resource.
  6. 06The authorization-server metadata URL is https://app.unsendbox.com/api/v1/mcp/.well-known/oauth-authorization-server.
  7. 07Run `claude mcp list` or `/mcp` to confirm the server connects and its tools are available.

3) Connect Claude Desktop or another OAuth-capable client

Use the same endpoint and let the client discover the authorization server.

  1. 01Add https://app.unsendbox.com/api/v1/mcp as the remote MCP server URL.
  2. 02When the client requests authentication, use OAuth discovery rather than an API-key header.
  3. 03Approve the requested scopes only after checking the client and redirect destination.
  4. 04For native clients, loopback callbacks may use a dynamic port when the registered callback is a portless localhost, 127.0.0.1, or IPv6 loopback URL.

4) Use an API key with a custom client

This path is for clients that can send the x-api-key header and do not use OAuth discovery.

  1. 01Go to Dashboard → Settings → API Keys and create or copy a key for the intended organization.
  2. 02Send the key as x-api-key on every MCP HTTP request. Do not put it in a URL, prompt, or public configuration.
  3. 03Pass organizationId only when the key is not already organization-bound or when selecting an allowed organization for an unbound key.
  4. 04A key-bound organization is authoritative. A conflicting organizationId request is rejected.
Example tool calls
create_address(domain="rebookos.win", local_part="hello", mirror_to=["hello@rebookos.io"])
list_threads(filter={"domain":"rebookos.win"})
get_thread(thread_id="thr_92f...")
reply(thread_id="thr_92f...", from="hello@rebookos.win", body="Thanks — here are next steps…")
send(to=["lead@company.com"], from="hello@rebookos.win", subject="Quick question", body="…", intent="outreach")

OAuth discovery contract

These are the local MCP OAuth facts clients can verify from the metadata endpoints.

Protected resource
https://app.unsendbox.com/api/v1/mcp/.well-known/oauth-protected-resource points back to https://app.unsendbox.com/api/v1/mcp.
Authorization server
The MCP metadata advertises /api/v1/mcp/oauth/authorize, /api/v1/mcp/oauth/token, and /api/v1/mcp/oauth/register.
Client registration
The server advertises Client ID Metadata Documents and supports dynamic public-client registration. The client decides whether to use CIMD or registration.
Organization selection
OAuth users with more than one organization must select an organization through the MCP request context. A token is not treated as permission to silently choose a different organization.

Verify your connection

After authentication, confirm both tool access and the organization context.

Discover tools
Run /mcp in Claude Code or the equivalent client command and confirm Unsendbox tools appear.
Check organization
Run list_domains or list_threads and confirm results belong to the selected organization.
Send a test email
Use send_email only with a verified sender and a recipient approved for your test.

Safety notes

Treat the client credential and the OAuth grant as production secrets.

Scopes
Request only the scopes the client needs and review consent before approving. The server advertises the full set above; the client may request a narrower set.
API keys
Rotate or revoke a key if it appears in logs, source control, screenshots, or chat.
Directory status
This documentation does not certify Anthropic directory submission, review, or listing status.