Developers

Email Alias API — Create aliases programmatically.

The Emcognito API is a small REST surface for creating and listing email aliases from your own code — scripts, CI pipelines, signup flows, or internal tools. Authenticate with a single API key sent as a Bearer token, send and receive JSON, and every alias you create behaves exactly like one made in the dashboard. API access is included with Plus and Pro plans.

Quick start

Create an alias:

curl -X POST https://api.emcognito.com/v1/aliases \
  -H "Authorization: Bearer emk_your_key" \
  -H "Content-Type: application/json" \
  -d '{"label": "acme-signup"}'

List your aliases:

curl https://api.emcognito.com/v1/aliases \
  -H "Authorization: Bearer emk_your_key"

The POST body is optional JSON. label, note, source and category are free text; single_use (boolean) burns the alias after one forwarded message, and expires_at (epoch seconds, between 5 minutes and 366 days out) schedules its deletion.

Endpoints

MethodPathPurpose
POST/v1/aliasesCreate an alias. Optional JSON body: label, note, source, category, single_use, expires_at.
GET/v1/aliasesList your aliases. Optional limit (1–100) and cursor pagination via last_key.

Responses

GET /v1/aliases returns a page of aliases plus an opaque cursor. Pass next_cursor straight back as ?last_key= to fetch the next page; it is null on the last one.

{
  "aliases": [
    {
      "id": "01hq…",
      "address": "01hq…@emcognito.com",
      "status": "active",
      "created_at": 1786000000,
      "forward_count": 3,
      "note": "",
      "source": "",
      "label": "acme-signup",
      "category": "",
      "single_use": false,
      "expires_at": null
    }
  ],
  "next_cursor": null,
  "has_more": false
}

POST /v1/aliases returns the one alias it created, in the same shape, under alias:

{ "alias": { "id": "01hq…", "address": "01hq…@emcognito.com", … } }

Two fields appear only when they apply: replies_enabled when replies have been configured on the alias, and suspended_reason when status is suspended.

Rate limits

Two separate budgets apply. The per-minute burst limit is counted per API key and covers every call; the daily cap counts alias creation only, so listing your aliases never consumes it.

CallsBurstDaily
Reads — GET /v1/aliases60/min
Writes — POST /v1/aliases60/minPlus 50/day · Pro 200/day

Both return 429. The burst limit clears within the minute; the daily cap resets at 00:00 UTC.

Authentication

Every request carries your API key as a Bearer token in the Authorization header. Keys are managed at /settings/developer — one key per account. Rotating or revoking a key invalidates the old one immediately, and keys only work while the account is on a Plus or Pro plan.

Errors

StatusMeaning
400A malformed limit or last_key, or an invalid single_use / expires_at in the body.
401Invalid or revoked API key.
403plan_required — the account is on the Free plan; the API needs Plus or Pro.
403plan_past_due — a payment failed. Paid API access pauses immediately until payment recovery restores paid access.
403plan_canceled — the subscription was canceled.
409Address collision while minting the alias. The API now redraws and retries internally, so a single collision never reaches you — a 409 means three independent draws all collided, which points at the service rather than at your request. Retrying is still safe.
429Over the burst limit or the daily creation cap. See rate limits above.
503Rate limiting is temporarily unavailable, so /v1 is closed rather than served unmetered. Honour the Retry-After header. This is a safety valve rather than a limit on your traffic: nothing you send causes it and retrying is correct. It normally clears in seconds. If it persists past a few minutes it is an incident on our side, not the routine case — the two responses are identical, so how long it lasts is the only way to tell them apart. Mail hello@wm.emcognito.com and we will tell you what is happening.

Plan and key errors carry {"code", "description"}; the rest carry {"message"}. Key off the status and the code where present.

Frequently asked questions

Is there a free API tier?

No. API keys are available on Plus ($2/month) and Pro ($4/month). Alias creation in the dashboard and extension is free and unlimited — the API is for programmatic use, and keeping it on paid tiers is how we keep it abuse-resistant and stable.

How many API keys can I have?

One per account. Generating a new key rotates the old one, which stops working immediately — the same applies when you revoke a key.

What are the rate limits?

Every call is capped at 60 per minute, counted per API key. Alias creation has a second, daily cap on top of that — 50/day on Plus and 200/day on Pro. Listing aliases does not consume the daily cap. Both limits return 429, and your existing aliases and mail forwarding are unaffected either way.

What happens to my API key if a payment fails?

Paid API access pauses immediately when payment is overdue. Calls return 403 plan_past_due until payment recovery restores paid access. Updating a card alone does not settle an invoice. Canceling outright returns 403 plan_canceled immediately.

Can I delete or suspend aliases through the API?

Not yet. v1 covers creating and listing aliases; suspend, resume, and delete from the dashboard.