What a 24-hour Cloudflare sign-in guarantees you
What the OAuth grant actually gives Flowmails, when it expires, and why the platform keeps no long-lived credential for your account.
Journal
Long-form writing about provider-connected email, provider-native routing, the REST API, and the parts of the platform that show up in the security review.
Categories
Tags
25 posts
What the OAuth grant actually gives Flowmails, when it expires, and why the platform keeps no long-lived credential for your account.
How to hand an AI agent a mailbox it can call on your own domain: a contract it cannot misremember (the skill), a key it cannot overspend, and an inbox it can verify — without inventing the API.
A suspended HTTP request dies on the edge long before the verification mail arrives. The wait is a row instead of an open connection: the platform answers immediately, the agent polls, and the answer survives the disconnect.
Cloudflare Email Routing is the world's best front door for inbound mail. It isn't a database, an inbox UI, a REST API, or a send path. Here's what you add — and why the answer is one email platform, not another SaaS.
Resend is the fastest possible first-send. Flowmails is the same primitive plus a hosted inbox, route tables, an event log, and no per-email markup. Pick based on which of those you actually want.
SendGrid is a great hosted ESP. If you want a named data boundary, no per-email markup, and inbound mail in the same place, Flowmails is the switch that keeps one operational model.
If your team only used Postmark for transactional mail, switching to Flowmails keeps the same shape and removes the per-email fee. Newsletter / broadcast stays on whatever tool you have.
Mailgun's hosted breadth (validation, lists, optimisation) is more than most teams need. Switch to Flowmails for send / receive; keep Mailgun only if you depend on its proprietary tools.
SES is excellent at volume. Flowmails is what you ship when you want inbound mail, route tables and an agent-usable API without a second cloud relationship — and no per-email markup on top.
Transactional-email pricing splits into per-email fees (Resend, SendGrid, Mailgun, SES), bundled tiers (Postmark Pro), and flat platform fees (provider-connected stacks like Flowmails). Here's the same-volume comparison.
Mail without operating an MTA: Cloudflare Email Routing plus one hosted worker gives you a full mail surface on the same runtime as the rest of your stack — no MTA, no Dovecot, no SpamAssassin.
Cloudflare's email path runs through four primitives that each bill separately. Here's how Workers per-request, Email Services per-email, D1 read/write/storage, and R2 storage / operations stack up — and how to keep the bill predictable.
Cloudflare Email Routing handles inbound. For sending, you need Email Services + a Worker. Here's the REST API contract for outbound send, how the threading shape works, and how Flowmails wraps it.
Cloudflare Email Routing + a small Worker + a D1 schema is enough to route inbound mail into a ticket pipeline. Here's the minimum viable ticket system and the schema behind it.
The Resend → Flowmails migration is mostly swap-the-SDK, but DNS, webhook fan-out, and template portability all have to land in the same PR. Here's the 8-step order that keeps the cutover reversible.
Run support@, billing@, and abuse@ inboxes across tenants on one shared worker. Per-tenant routing, metadata injection, webhooks, and the schema to back it.
Receive email events in a Cloudflare Worker: HMAC-SHA256 signature verification, retry schedule, idempotency key (SMTP Message-ID), and the failure modes that catch teams out.
Cloudflare Email Routing auto-signs DKIM for the zone. You still publish SPF and DMARC yourself. Here's what each record does, the exact strings to use, and how to monitor your alignment.
Why most transactional-email providers are overkill for a small team, and how one provider connection plus an API key gets you there in a day.
An email API starts with where the data lives: one hosted worker scoped by domain id, and what that means in practice for compliance, exports, and exit plans.
A tour of the runtime behind Flowmails: Email Routing, the shared worker, the per-domain routing address, and the tables behind a single inbound message.
Why a catch-all isn't always enough, how Flowmails route tables enforce an address allow-list per domain, and how to switch safely.
The shape of the Flowmails API, how the durable event log and the durable wait replace polling, and a worked example of inbound-to-ticket automation in 30 lines.
The exact permissions Flowmails needs, the principle of least privilege, and the audit trail you can show your security reviewer.
A provider-connected email platform: one shared mail worker, a domain-scoped inbox, and a REST surface your agent can call.