Business email: SMTP, IMAP and app configuration

Builder includes up to 3 inboxes and Operator up to 6, shared across all your domains. Free accounts cannot create inboxes. Aliases share an inbox; they are not separate accounts. Pending or failed mailbox provisioning reserves a slot until removed. Downgrading does not delete existing mailboxes, but you cannot create more while at or above your plan's allowance.

Connection settings

Use the full email address as your username and the mailbox password, not your Portacode login password. The current settings are also available under your domain's Email controls.

Always verify the server certificate. Do not use unencrypted SMTP or IMAP. Port 465 uses TLS from the start; it is not STARTTLS. Set the sender display name in your app as well as the mailbox settings.

Let Dashboard AI configure your app

1. Ask Dashboard AI to create an inbox on your verified email domain. The creating chat receives Use & manage access to that mailbox only. Other chats receive no automatic access.
2. For an existing inbox, open AI access → Business email → Add, select the inbox, and choose Use in apps or Use & manage. Choose the current thread or dashboard defaults. A thread's explicit No access overrides the default.
3. Grant the chat write access to the target device separately. A device grant never grants mailbox access.
4. Ask the AI to configure the app using that mailbox. It can call dashboard_manage_email with configure_app, the mailbox and device IDs, and a new private JSON filename outside public web directories and version control. The tool creates a missing parent directory with mode 0700; an existing parent must already be private.

The private JSON file (mode 0600) contains only email and password. The password is not returned to the AI. Connection constants belong in the app's SMTP configuration, not in the credential file. Both configure_app and connection_help return an app_configuration recipe with the current host, ports, TLS mode and library mappings.

Configure SMTP without guessing

Read the two values from the JSON file in server-side code at runtime. Use email as the authentication username and default From address, and password as the authentication password. Use mail.portacode.com:465 with implicit TLS, keeping certificate verification enabled. Do not call STARTTLS on port 465.

• Nodemailer: host: "mail.portacode.com", port: 465, secure: true, auth: {user: credentials.email, pass: credentials.password}. Use credentials.email as the message's from. Call await transporter.verify() to check connectivity and authentication without sending a message.
• Django: EMAIL_HOST = "mail.portacode.com", EMAIL_PORT = 465, EMAIL_USE_SSL = True, EMAIL_USE_TLS = False, EMAIL_HOST_USER = credentials["email"], EMAIL_HOST_PASSWORD = credentials["password"], DEFAULT_FROM_EMAIL = credentials["email"]. Open and close django.core.mail.get_connection() to check authentication without sending mail.
• Python smtplib: use smtplib.SMTP_SSL("mail.portacode.com", 465, context=ssl.create_default_context(), timeout=20), then login(credentials["email"], credentials["password"]).

The app's runtime user must be able to read the file. For a containerized app, mount it read-only and use the path inside the container. Do not expose it to browser code, print it, commit it, or paste it into chat. A successful file write is only the credential step: wire the app's mail library and verify SMTP authentication before reporting configuration complete. Send a test message only to an intended recipient when authorized. SMTP authentication alone does not prove delivery.

Files installed before this simplification retain their previous keys and remain usable; existing apps do not need to be changed. Newly installed files use only email and password.

Older mailboxes whose password was not stored securely need a one-time password reset through the Email controls before this feature can be used. Passwords cannot be recovered from the mail server. The AI can open the secure form for you; it should never ask you to type a password into chat.

Manage access and passwords

Use Email to change passwords, sender names and aliases, check DNS and usage, or confirm permanent deletion. Dashboard AI can show a Manage email or Change password button for an individual inbox. Password fields are handled by your browser and the server, outside the conversation.

Credentials are encrypted at rest. Use in apps allows installing them on an authorized device; Use & manage also permits mailbox administration. Deletion still requires explicit confirmation. Revoke either permission through AI access to block future mailbox operations. Revocation does not erase copies already installed in apps: rotate the password to invalidate those copies and update the apps you still want to use. A device with AI read access may expose files on that device, so only install credentials on a trusted device.

For live connection settings, Dashboard AI should use dashboard_manage_email → connection_help. For secure administrative controls, use manage_ui or reset_password. Never include passwords in tool arguments, logs, source code or chat messages.