Building an “Import from Infrabox” Feature

This page is for sequencer / cold-email sending platforms (Smartlead, Instantly, Lemlist, Apollo, and similar) that want to let their own users pull mailboxes straight out of Infrabox — the same pattern several mailbox-infrastructure providers already offer as an “Import from …” option inside a sending tool’s own UI.

The flow is entirely pull-based and needs nothing custom on Infrabox’s side beyond a plain API key: your user enters their own Infrabox credentials into your product, and your backend calls Infrabox’s API directly.

Ask your user for two values

From their Infrabox dashboard, your user needs:

Their API key (Settings → API)
The workspace UID they want to import from (GET /v1/api/workspaces/list if they have more than one, or from the workspace switcher URL)

An Infrabox API key is a full-privilege, team-scoped credential — not limited to reading mailboxes. Anything holding it can also register domains, spend wallet credits, and manage billing on that team. Tell your users to only paste it into products they trust, and that revoking a key (from Infrabox Settings → API) is immediate if anything looks wrong. Store it the way you’d store any other secret API key your users give you — encrypted at rest, never logged.

List their mailboxes


curl -X POST https://api.infrabox.software/v1/api/mailboxes/list \
  -H "Authorization: Bearer THEIR_API_KEY" \
  -H "X-Workspace-Id: THEIR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "status": "active", "limit": 100 }'

Filter to "status": "active" — a mailbox mid-provisioning has no usable credentials yet. Each row gives you username, domain_name, and platform (GOOGLE / MICROSOFT / AZURE); the address itself is username@domain_name. See Mailboxes for the full response shape.

Mint a sending credential for the ones the user picks


curl -X POST https://api.infrabox.software/v1/api/mailboxes/smtp-credentials/issue \
  -H "Authorization: Bearer THEIR_API_KEY" \
  -H "X-Workspace-Id: THEIR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "uids": ["<mailbox_uid>", "..."] }'


{
  "error": false,
  "results": [
    {
      "uid": "mb_111",
      "success": true,
      "host": "smtp.infrabox.software",
      "port": 2587,
      "security": "STARTTLS",
      "username": "[email protected]",
      "password": "generated-once-password",
      "warning": "shown once"
    }
  ]
}

Do not use /v1/api/mailboxes/show-credentials for this. That endpoint returns the mailbox’s own Google console password, which Google rejects outright over SMTP (534 5.7.9 WebLoginRequired) — mailboxes send through the Infrabox relay, not directly against Google, and the relay only accepts its own issued credentials.

The password is returned exactly once — store it in your own system immediately, the same way you’d store a customer’s SMTP password for any other provider; it cannot be retrieved again. A mailbox that already has one comes back as credential_already_issued on a repeat call rather than silently reissuing (which would break whatever was already using the old password) — pass "rotate": true only if you specifically intend to replace it.

Currently only GOOGLE mailboxes can receive a credential this way; a MICROSOFT/AZURE uid comes back with error: "unsupported_platform".

Connect via SMTP

Use the host/port/security from the response above — username + password from the same response authenticate directly, no separate IMAP/SMTP-host lookup needed. This is a single relay endpoint for every mailbox on the platform, not a per-provider host like Gmail’s or Office365’s own.

Keeping it in sync

There’s no webhook push for “a new mailbox became active” today — if you want newly-provisioned mailboxes to show up on your side without the user re-running the import, poll POST /v1/api/mailboxes/list on an interval (a few minutes is reasonable) and diff against what you’ve already imported by uid.

Not what this page covers

Infrabox also has a push direction — POST /v1/api/sequencers/export lets an Infrabox customer connect their mailboxes into a sequencer they’ve already configured credentials for inside Infrabox itself. That’s the mechanism described on the Sequencers page, and is a separate integration model from the one on this page (here, your platform is the one calling Infrabox; there, Infrabox is the one calling your platform).