Your mailcow keeps the mail; this extension gives your own programs a controlled way in. Make an API key in the mailcow admin page, choose the mailboxes it may use and the rights it has, and call the API from a script, a CRM or an automation. Separately, pick the mailboxes you want to watch: every new message can be sent to your webhook as JSON and to a Telegram chat.
What it does
- API keys made in System → Mailbox API: each key has rights — read, send, organize — and is limited to the mailboxes you choose. Only the SHA-256 of a key is stored; it is shown once, when it is created.
- Read: list folders and messages, search, read a full message (text, HTML, headers and attachments), with pagination. Attachments come as signed links (1 hour, bound to the API key that can read the mailbox), so they can be downloaded without sending the key.
- Send: send a message as the mailbox (to, cc, bcc, subject, text or HTML, reply-to); a copy is put in Sent.
- Organize: mark read or unread, move to another folder, delete.
- Webhooks: for each monitored mailbox, an https address and a secret. Every new message in the watched folder is sent as JSON (from, to, cc, subject, date, message id, text, HTML, headers, attachments with name, type, size, sha256 and a signed link), signed with
X-MLW-Signature(HMAC-SHA256, Stripe style). Failed deliveries are retried with a growing delay and listed in the admin page. - Telegram: one bot token and a chat per monitored mailbox, with a test button. The message shows the sender, the subject and the first lines.
- Everything stays on your server: the API reads mail through dovecot's master login, inside the mailcow network (the same mechanism mailcow itself uses for imapsync). Nothing is sent to medialab.works; only your own webhooks and Telegram chats receive data, because you set them.
Requirements
- mailcow-dockerized with the MediaLab Works mailcow Toolkit 0.5.0 or newer installed (this product is one of the modules in that package, with its own license).
- Root access on the host to install the Toolkit; the server must reach
medialab.worksover HTTPS for the license check. - For webhooks: an https endpoint of your own; for Telegram: a bot token from @BotFather and the chat id of each mailbox.
- Open source (GPL-3.0): you receive the complete source code.
Limits and privacy
- Each key only reaches the mailboxes and the rights you chose; every call is logged.
- The API is off until you enable it; without a valid license the API and the notifications stop, and nothing is deleted.
- Message contents are never sent to us: they go to the webhook and the Telegram chat you configured. Signed attachment links expire after 1 hour and are bound to the API key that can read the mailbox; regenerating them means reading the message again through the API.
- The API does not create, delete or change mailboxes; it only works inside the mailboxes you allow.
Licensing
One license per mailcow server, monthly or yearly subscription or lifetime, with the 30-day free trial. Without a valid license the module stops (the admin page says so); mailboxes and messages are untouched. See Pricing and the installation and API guide.