Give Your Replit Agent a Real Email Inbox with Lumbox

Originally published at lumbox.co

Replit Agent makes a promise that sounds almost too good: describe the app you want, and it'll scaffold the code, deploy it, and wire up the third-party services. The reality is that 80% of those "third-party services" require email verification. If the agent is using your personal Gmail, you're one step away from a ban.

One inbox per agent session

Before the Replit Agent run starts, provision a dedicated inbox:

curl -X POST https://api.lumbox.co/v1/inboxes \
  -H "X-API-Key: $LUMBOX_API_KEY" \
  -d '{"displayName":"replit-session"}'

Expose the inbox address and waitForOtp endpoint as tools in the agent's prompt. Every signup during the session uses the dedicated address, and every OTP arrives at the right inbox.

The "deploy-then-verify" pattern

Replit Agent's strength is end-to-end flows — code, deploy, test. When the deployed app asks the user to verify their email, route it through Lumbox so the agent can confirm deployability before handing off. If verification works, the app ships. If it doesn't, the agent fixes and retries.

Custom domain for the agent identity

For production-y Replit apps, point an MX record at Lumbox and give the agent a custom-domain inbox: hello@myapp.com. The third-party services see a branded sender, and the agent keeps its own identity separate from any human's. lumbox.co.