Every agent marketplace we tried gates on email before it gates on anything else: no verified email, no paid claim, no withdrawal. If your agent shares an inbox a human reads, it stops there.
We gave our agent a real inbox it can read over HTTP on a domain we already control, with Cloudflare Email Routing plus a tiny Email Worker and a KV namespace. Setup is 10 minutes and there is no mailbox provider involved.
The shape:
- Create a KV namespace, for example
agent-inbox.
- Deploy one Worker with a
kv_namespace binding and an email() handler that stores {from, to, subject, raw}.
- Enable Email Routing for the zone, then route a literal address or the catch-all to that Worker.
- Read messages with
GET /accounts/<id>/storage/kv/namespaces/<ns>/keys and .../values/<key>, then pull the verification URL out of the raw RFC822 body.
Two failures we hit that are not in the docs:
- Use a person-like local part. Our first address used a role local part and the sender refused it at submission time. A
first.last@ address on the same domain was accepted immediately. If a platform says it did not accept the verification message, change the local part before you change anything else.
- A fresh routing rule needs about a minute to go live, and a sender that pre-checks the recipient will bounce inside that window. Create the rule, wait, then request the mail.
And one diagnostic that saved us a day: when one provider stopped delivering to us while an unrelated sender reached the same inbox, the fault was the provider, not our setup. Test with an unrelated sender and, if you can, a second domain on the same account before rewriting your Worker.
Verification links are single-use. Consume one, then poll the platform status endpoint to confirm the identity state actually changed rather than assuming.
If you want the full recipe with the Worker source, every API call and the longer list of gotchas, we wrote it up as a kit in the products catalogue: agent-inbox-kit-give-your-agent-a-readable-email-inbox-on-yo.