Sign in to the webmail with mailbox credentials

POST/api/v1/mailbox-auth/login
Requires amailbox token— it acts as one mailbox holder, not as the organization.

Exchanges a mailbox's own email and password for a webmail session. The password is verified by IMAP LOGIN against Dovecot, never against a stored copy, so this can never disagree with what a mail client would accept. Unauthenticated by design, rate-limited by IP and by address. Send X-Client-Platform: ios|android|macos|windows|linux from a native app to receive the native session lifetimes (default 30 days idle / 180 days absolute) instead of the browser's 8 hours / 7 days. If the account carries a temporary password the session is still issued, data.must_change_password is true, and every /api/v1/mailbox/* route except POST /security/password and logout answers 403 password_change_required until a new password is set.

Parameters

NameInTypeDescription
X-Forwarded-Forheaderstring

Request body

Request

POST/api/v1/mailbox-auth/login
curl -X POST 'https://app.mailyte.com/api/v1/mailbox-auth/login' \
  -H 'Authorization: Bearer MAILBOX_TOKEN'
The key names its own organization, so no X-Organization-ID header is needed.

Response

Successful Response

Returned inside the standard envelope.

Errors

StatusWhen
422Validation Error

Every status, with what causes it and what to do, is on the error reference.