> ## Documentation Index
> Fetch the complete documentation index at: https://inbound.new/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and Limits

> Restrict a credential's protocols and IP addresses, cap its storage and sending, and choose what mailbox users manage themselves

Each managed credential has optional controls on top of its [scopes and permissions](https://inbound.new/docs/mailboxes/scopes-and-permissions.md). Set them when you create the credential or later with `PUT /mailboxes/{id}`; list and get responses include them. Every control is optional and nullable, and `null` resets it to its default: no extra restriction, and no self-service.

```json theme={null}
{
  "protocols": { "imap": true, "smtp": true, "api": false },
  "allowedIps": ["203.0.113.0/24", "2001:db8::/32"],
  "storageQuotaBytes": 52428800,
  "dailySendLimit": 500,
  "selfService": { "filters": true, "spam": true, "password": false }
}
```

Only the account (an account API key or the dashboard) can change these controls. A mailbox password can never raise its own limits.

## Protocols

`protocols` turns each way of using the credential's password on or off:

| Key | Controls |
| - | - |
| `imap` | IMAP login |
| `smtp` | SMTP authentication and sending |
| `api` | HTTP requests authenticated with the mailbox password, such as `/mailboxes/me/...` and `POST /emails` |

`null` enables all three, and so does a key left out. On update, the keys you send are merged with the current values. SMTP keeps working when `api` is `false`: SMTP sends are relayed through Inbound's own trusted gateway, not through the credential's API access. `protocols` limits the mailbox password only; the account API key can still manage the mailbox through `/mailboxes/{id}/...`.

## Allowed IP addresses

`allowedIps` is a list of up to 100 IPv4 and IPv6 addresses or CIDR ranges, such as `198.51.100.7`, `203.0.113.0/24` or `2001:db8::/32`. A bare address means that address only. When the list is set, the password only authenticates from a client address inside one of the ranges; IPv4-mapped IPv6 addresses match IPv4 ranges. `null` or `[]` allows any address, and responses show it as `[]`.

Entries are stored normalized: host bits are cleared, so `203.0.113.7/24` is saved as `203.0.113.0/24`; a bare address gets `/32` or `/128`; an IPv4-mapped IPv6 address such as `::ffff:192.0.2.1` is saved as `192.0.2.1/32`; and duplicates are removed. An invalid entry returns `400`.

Inbound only checks a client address it can trust:

* **IMAP and SMTP**: the address of the client connecting to Inbound's gateway. The gateway forwards it to the API together with a shared gateway secret; a forwarded address without a valid secret is ignored.
* **HTTP**: on Inbound's hosted API, the client address from the platform's `x-vercel-forwarded-for` header, which clients can't set themselves. Other forwarding headers are ignored. A self-hosted deployment outside Vercel has no trusted client address, so a password with a non-empty `allowedIps` is refused for every HTTP request.

When no trusted address is available and `allowedIps` is set, authentication fails closed.

> [!NOTE]
>
> A disabled protocol or a disallowed IP address fails like a wrong password: IMAP returns `NO [AUTHENTICATIONFAILED]`, SMTP returns `535`, and HTTP returns `401`. The response doesn't say which check failed, so check these settings when a correct password is refused.

Protocol and IP changes apply to each new login or request. An SMTP session that is already logged in gets `550` on its next message. Changing `protocols`, `allowedIps` or `selfService` immediately logs out the credential's active IMAP sessions. Clients must reconnect using the current settings. You can also [rotate the password](https://inbound.new/docs/mailboxes/manage-credentials.md#rotate-a-password) to revoke the previous password.

## Storage quota

`storageQuotaBytes` caps, in bytes, the content this credential stores itself: messages appended over IMAP or HTTP, drafts and saved Sent copies. Received mail doesn't count. Each stored message counts once, even when it is in several folders of the credential. `null` means no per-credential cap; the minimum is `1`.

The [account-wide appended storage limits](https://inbound.new/docs/mailboxes/imap-behavior.md#message-and-storage-limits) still apply. An append over either limit is rejected: IMAP returns `NO [OVERQUOTA]` and HTTP returns `413` (`Mailbox storage quota exceeded`). An automatic Sent copy that doesn't fit is skipped; the send itself still goes out.

## Daily send limit

`dailySendLimit` caps how many sends and replies this credential's password can make per UTC day, across SMTP and HTTP, from `0` (no sending) to `1,000,000`. `null` means no per-credential limit; account sending limits still apply either way.

Sends made while the limit is `null` aren't counted if you set a limit later that day.

* Each message counts once when it is accepted for delivery, whatever its number of recipients. A send the email provider rejects is not counted, but a message that later bounces still counts.
* Retrying a send with the same `Idempotency-Key` after it was accepted doesn't count again.
* Concurrent sends can't exceed the limit. The counter resets at 00:00 UTC.
* Sends authorized with an account API key don't count toward any mailbox's limit, even when they save a copy to its `Sent`.
* A password with a daily limit can't schedule sends: `scheduled_at` returns `400`.

Over the limit, HTTP sends return `429` and SMTP returns a temporary `451`. Retry after 00:00 UTC.

## Self-service

`selfService` chooses what a mailbox user can manage with their own password through `/mailboxes/me/...`:

| Key | Allows |
| - | - |
| `filters` | [Filters](https://inbound.new/docs/mailboxes/filters.md) at `/mailboxes/me/filters` |
| `spam` | [Spam settings](https://inbound.new/docs/mailboxes/junk-filter.md#per-mailbox-spam-settings) at `/mailboxes/me/spam` |
| `password` | `POST /mailboxes/me/rotate-password` |

`filters` works for read-only mailboxes too: their password can list, create, update and delete filters. Applying filters to existing mail (the `apply` endpoints) still needs a **Read & write** mailbox. `password` also works for **SMTP only** credentials. Every `/mailboxes/me/...` request also needs `protocols.api` on and an allowed IP address.

`null` turns all three off, and so does a key left out. On update, the keys you send are merged with the current values. Requests for a setting that isn't enabled return `403`. The account API key can always manage these settings through `/mailboxes/{id}/...`.

```bash theme={null}
curl -X POST "https://inbound.new/api/e2/mailboxes/me/rotate-password" \
  -H "Authorization: Bearer $MAILBOX_PASSWORD"
```

The response contains the new password. The old one stops working immediately, including for the IMAP and SMTP clients that use it.

> **[Manage Credentials](https://inbound.new/docs/mailboxes/manage-credentials.md)**
>
> Create, update, disable and rotate credentials.

> **[Mailbox Filters](https://inbound.new/docs/mailboxes/filters.md)**
>
> Sort, flag and junk received mail with ordered rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.