Changelog

The first release: the whole of OpenEmail from a terminal, with a browser sign-in for people and API keys for scripts.

• —Sign-in: openemail login in the browser, returning to the terminal on its own on a desktop and through a pasted code over SSH or with --no-browser. API keys with --token, --with-token, OPENEMAIL_API_KEY or --api-key. Profiles with profile list, use, current and remove.
• —Access tokens renewed before they run out, one renewal at a time per profile, and refresh tokens that work once: an old one used more than 30 seconds after it was replaced makes the server revoke that sign-in.
• —A saved sign-in only ever goes to the API it signed in to. Plain http is refused except on localhost, 127.0.0.1 and ::1, and a request path that would leave the API origin stops with invalid_path.
• —Verification codes before sensitive changes with a browser sign-in, asked for when a command needs one, or ahead of time with openemail verify. They cover the REST API and the MCP tools that make the same changes.
• —Each sign-in can ask for 5 codes an hour and 20 a day. Ten wrong codes in 24 hours pause its verification, and the CLI says when it resumes and exits with code 4 and step_up_paused.
• —whoami, status, and logout, which revokes a browser sign-in on the server.
• —Sending with send: text, HTML, a file, stdin or your editor, attachments of any size, scheduling, an undo window, translation, templates and tags.
• —The mailbox: inbox, search, read and reply, and archive, unarchive, trash, star, unstar, mark, snooze, unsnooze and label.
• —Disposable inboxes with temp new, list, read, watch and delete, with no sign-in.
• —A resource command for every method of the SDK: 282 methods as 198 commands in 26 namespaces, with security left out of the help because openemail verify covers it. Typed flags, --data from JSON, a file or stdin, paging with --all, --max and --ndjson, downloads with --out, and a confirmation before anything destructive.
• —AI: ai translate, ai languages, ai compose and ai summarize.
• —MCP: mcp config for Claude Code, Claude Desktop, Cursor, VS Code, Windsurf and Codex, mcp serve as a local stdio bridge, and mcp tools and mcp call, which asks for a verification code and calls the tool again when a tool needs one.
• —docs ask, docs open and docs read, open for the pages of the web app, and api for any REST call.
• —Scripting: --json with an error envelope on stderr, NDJSON streams, stable exit codes, --no-input, and CI detection.
• —Help for every command and group, suggestions for mistyped commands and flags, and completion for bash, zsh and fish.
• —Sign-ins and inbox tokens in ~/.openemail, readable by you alone and changed under a lock file, and a damaged config.json kept as config.json.bak rather than read as signed out.
• —Text from the server is cleaned before it reaches the terminal, and output piped to a slow reader is written in full before the CLI exits.
• —A daily update notice, which OPENEMAIL_NO_UPDATE_CHECK=1 turns off, and openemail update.
• —One bundled file with no dependencies, on Node.js 20.12 or later.

Not in this release: billing, workspaces, account security, data export, calendar changes, forwarding, linking a DNS provider and the assistant chat stay in the web app for now, and openemail open takes you to each of them.

npm install -g @openemail/cliopenemail loginopenemail inbox