Find a code
Search unread mail from the selected sender.
Local-first / Cloudflare-ready
Mailbox
Control Room.
Manage encrypted mailbox credentials, inspect safe account metadata, and pull the latest OTP without exposing secrets in URLs.
SESSION: checking
Cloudflare Access OTP protects this admin hostname. API key/device session remains available for workers.dev and local use.
Session
Cloudflare Access OTP can sit in front of this Worker. The app session below is an additional device-bound layer.
Result
Ready.
Safe account data
Passwords and OAuth tokens are never returned.
Gmail: -
Outlook: -
| Service | Auth | Updated | |
|---|---|---|---|
| Login to load accounts. | |||
Add mailbox
Credentials are encrypted before D1 storage.
Import list
One account per line: email|secret or email|token|oauth2.
API map
JSON responses include status and timestamp. Replace BASE_URL with this Worker URL.
| Method | Endpoint | Purpose | Auth |
|---|---|---|---|
| GET | /health | Service/account health | Public |
| GET | / | Admin dashboard | Cloudflare Access OTP |
| POST | /auth/login | Create device session | App login (fallback) |
| POST | /gmail/add_email/outlook/add_email | Encrypt and save one mailbox | Access/API key/session |
| POST | /gmail/import_list/outlook/import_list | Import email|secret lines | Access/API key/session |
| GET | /accounts/gmail/accounts/outlook | List safe metadata only | Access/API key/session |
| GET | /gmail/get_otp/outlook/get_otp/outlook/v2/get_otp | Find latest matching OTP (v2 legacy alias) | Access/API key/session |
Quick examples
Trusted IPs can call directly; other clients need an API key. Default OTP lookback is 10 minutes. Set lookback_minutes only when needed.
BASE_URL="https://api-email.dinhlieu.com" API_KEY="..." curl "$BASE_URL/gmail/get_otp?receiver=you@gmail.com&sender=amazon.com&otp_length=6" -H "X-API-Key: $API_KEY" curl "$BASE_URL/accounts/gmail" -H "X-API-Key: $API_KEY"
Security notes
- Protect email-api.dinhlieu.com with Cloudflare Zero Trust Access and One-time PIN.
- rd.dinhlieu.com is untouched and is not proxied by this app.
- Trusted IPs resolve dynamically from TRUSTED_HOSTS; no fixed IP is stored.
- Browsers cannot expose real MAC addresses; device sessions use a random browser ID.
- IMAP is attempted first; POP3S fallback is used when enabled.