Agent identity & 2FA
A digital passport for your AI agent.
Most agent tasks stall at sign-up because the verification code goes to a person. An agent inbox closes the loop.
Why agents stall on the open web.
The internet uses email as the root of identity. When an agent borrows a human's address, three things break at once.
The human-shaped hole in 2FA
An agent fills out a form in seconds, then waits hours for a person to paste a six-digit code.
Borrowed identity and mixed risk
Using your own address hands the agent access to your personal password resets, bank notices and private threads.
Colliding sessions across workers
When five agents share one login email, security alerts, magic links and receipts pile up with no clear owner.
Digital passport
An agent can operate as its own entity online.
To sign up, connect, and work across the internet, an agent needs an identity it owns. Its inbox receives the codes and links that let it in.
What an inbox solves, and what it does not.
- Email verification codes (2FA / OTP)Solved
Arrives as plain text in milliseconds; the agent reads the digits and submits them.
- Magic links and confirmation emailsSolved
The agent extracts the verification link from the message body and follows it.
- Receipts, invoices and security alertsSolved
Kept in the agent's own threads with PDF attachments already read into text.
- Per-agent isolation and key revocationSolved
Each agent uses its own address and scoped key; revoke one without breaking others.
- Phone text messages (SMS codes)Not email
An inbox receives email, not phone texts. Services requiring SMS need a phone number.
- Human puzzle screens (CAPTCHA)By design
Puzzle screens exist to block software. Doorman does not bypass human puzzles.
Three authentication loops your agent can run alone.
With an address on doorman.fyi and a live stream, your agent handles verification inside its normal run.
- Loop 01
Six-digit email OTP
The service sends a passcode to the agent's address. The agent reads the event, matches the digits, and submits.
// 1. Subscribe to the agent's own inbox stream ws.send(JSON.stringify({ type: "subscribe", inbox_ids: [inboxId] })); // 2. Extract the 6-digit code when message.received lands const otp = event.message.body_text.match(/\b(\d{6})\b/)?.[1]; - Loop 02
Magic links and confirmation URLs
When an app sends a sign-in link, the agent pulls the confirmation link from the text and finishes sign-in.
// Match the verification link from the plain-text body const url = event.message.body_text.match(/https:\/\/[^\s>"]+/)?.[0]; if (url) await fetch(url);
- Loop 03
Ongoing account stewardship
After sign-up, billing receipts, usage alerts and support replies stay in that agent's inbox, threaded and read.
// Query only unread threads in the agent's mailbox GET /v1/inboxes/inb_01j9x7a0q2/threads?isRead=false // PDF invoices arrive with parsedText already populated
Event-driven runs
An email becomes the next agent run.
Do not run a loop that asks every minute if mail has arrived. Subscribe once, and let an incoming email start your agent.
Mail lands at SMTP
A customer or service writes to support@doorman.fyi.
Threaded and read
Doorman links the thread, checks authenticity, and reads PDFs into text.
Webhook or stream fires
Your server gets a signed delivery or a live frame over the socket.
Agent acts and replies
Your agent wakes with full context and replies in the same thread.
Get started
Open the door.
Create an account with an address you own. The console gives you your first key, and your agent is reading mail.
Already have an account? Open the console