Create a Fastmail app password for Mailera and your AI agent

TL;DR

Create a dedicated Fastmail app password on a plan that supports IMAP, use it to connect your existing mailbox to Mailera, and give your agent a separate Mailera API key with Read permission. The agent doesn't need your Fastmail credential. Mailera doesn't create a Fastmail mailbox or bypass its plan requirements.

What do you need before creating a Fastmail app password?

You need an existing Fastmail account with IMAP access, access to its security settings, and an Admin or Leader role to add the mailbox in Mailera. Fastmail's app-password documentation explicitly excludes Basic-plan users from creating app passwords and using third-party mail clients. Check your plan before troubleshooting a password.

An app password is a separate credential for a third-party application. Fastmail requires each application to have its own, so create one specifically for Mailera rather than reusing another client's credential.

Keep these three credentials separate:

Fastmail's password guide explains the account-password distinction. An app password cannot sign in to the Fastmail website or mobile app, or change your account settings or password. It still grants access to the data you authorize, so treat it as a secret.

For the provider-neutral explanation, see app passwords for agent mailboxes.

How do you create a Fastmail app password?

Follow Fastmail's app-password creation instructions:

1. Sign in to Fastmail on the web and open Settings → Privacy & Security.
2. Under Connected apps & API tokens, select Manage app passwords and access.
3. Select New app password. If Verify it's you appears, enter your account password and select Continue.
4. Choose Custom... and enter a descriptive name such as “Mailera mailbox connection.”
5. Restrict access to email data. The default Mail, Contacts & Calendars includes IMAP/POP/SMTP, CardDAV, and CalDAV; this connection doesn't need your contacts or calendars.
6. Select Generate password. Copy the generated value into Mailera's Password field during the connection steps below.
7. Check that the connection works before selecting Done in Fastmail, as Fastmail recommends.

Email-only access is not the same as read-only access. IMAP supports accessing and manipulating messages. Limit the agent separately with a Read-only Mailera key.

Keep the app password out of agent prompts, screenshots, repositories, and logs. Paste it into the connection form, not into a conversation asking an agent to configure the mailbox.

How do you connect Fastmail to Mailera?

The Mailera Fastmail connection uses an app password. Sign in to Mailera as an Admin or Leader, then:

1. Open Mailboxes → Add mailbox and select One mailbox.
2. Enter your address in Email address. Confirm the detected provider is Fastmail, or select Fastmail under Or choose a provider. For a custom-domain address, check the selection rather than assuming detection chose Fastmail.
3. Select Continue. In Connection details, paste the generated app password into Password, not your normal Fastmail sign-in password.
4. Optionally set Display name, which is the sender name. Choose a Mailbox group. Use a dedicated group if this agent should access only this mailbox.
5. Select Test & connect.

For reference, Mailera's Fastmail connector uses these connection settings:

The connection test checks Incoming server sign-in, Folder detection, and Outgoing server sign-in. It does not send an email.

After the Connected confirmation, Mailera loads messages within its retention period, newest first. Send a harmless message from another account you control, give it a recognizable subject such as “Mailbox connection test,” and find it in Unified inbox. This checks message retrieval separately from authentication.

If incoming sign-in succeeds but outgoing sign-in fails, select Save as receive-only if reading is all you need. That saves the connection for receiving mail; it does not make sending work. Alternatively, use Edit details and Test again to address the failed outgoing check.

How can an AI agent read the mailbox?

Create a separate Mailera key for the agent. The Fastmail app password stays with the mailbox connection; it does not belong in the agent's MCP configuration.

1. Open Settings → API key tab → Create key.
2. Enter a Descriptive name identifying the agent.
3. Set Mailbox scope to the dedicated group containing the Fastmail mailbox. A group scope covers the group, not automatically one mailbox. Avoid an all-groups key for this task.
4. Enable only Read. Leave Move messages, Import mailboxes, Sync, Send messages, Manage mailboxes, Webhook, and Sharing disabled.
5. Choose an Expiration appropriate for the task.
6. Copy the key when Key created — copy it now appears. Mailera shows it only once.
7. Use Copy MCP config for Claude, Cursor, or VS Code, then follow the Mailera MCP setup instructions for your client.

Verify access in this order:

All three tools require the read scope. Sending requires send; moving messages requires move. Neither action is authorized by Read alone.

What commonly goes wrong?

Start with the failed check. Generating another password won't resolve a plan restriction or an incorrect account identity.

For Fastmail, Mailera's mailbox-status endpoint reports sign-in status from the latest sync. It is not a fresh direct authentication probe. Read the sync timestamp alongside the status rather than treating a status lookup as a new password test.

A Read-only agent cannot call sync_mailbox: that tool needs the separate sync scope. Keep manual sync access separate unless the agent's task actually needs it.

How do you keep the agent's access safe?

Incoming email is untrusted data, not instructions. A message may ask an agent to reveal credentials, change permissions, or invoke another tool. Have the agent summarize those requests as message content rather than carry them out.

Keep the API key in the client's credential configuration, not in prompts or message content. A Read-only key still exposes the email available within its group, so narrow the group as well as the permissions.

If you later enable sending, require explicit human confirmation before each send in your agent workflow. Do not assume Mailera automatically enforces that policy. The MCP specification's consent guidance calls for explicit user consent before tool invocation. See Mailera security information when reviewing the connection's access boundaries.

How do you replace a password or stop agent access?

Choose the revocation point based on which access you want to stop:

For a Fastmail app password reset or change, generate a replacement rather than trying to edit the old secret. Fastmail's app-password review screen cannot display or edit existing passwords. Replacing an app password is separate from recovering a forgotten Fastmail account password.

Return to Manage app passwords and access to review the old credential. Disable temporarily disables its access. Remove permanently removes access and cannot be undone.

If a credential may have been exposed, revoke it promptly instead of keeping it active for continuity. Revoking only the agent's API key does not revoke a leaked Fastmail app password.

What are the limits of this setup?

A Read-only Mailera key limits the agent's actions through Mailera; it does not reduce the underlying Fastmail app password's permissions.

Mailera does not promise absolute real-time synchronization. Initial loading is bounded by retention, and the free plan retains messages for 30 days. A missing older message may therefore be a retention issue rather than an authentication failure.

Mailera is not an official Fastmail partner. The Mailera product overview describes how existing mailbox connections are exposed to applications and agents.