Mailbox warmup and monitoring compatibility

Mailbox compatibility has three independent axes:

1. Origin — where the mailbox entered Oxygen: InboxKit, legacy CMR, Hypertide, Zapmail, manual, or native.
2. Infrastructure platform — where the mailbox is actually hosted: Google Workspace, Microsoft 365, or InboxKit Azure.
3. Downstream authentication — a scoped Google SMTP/IMAP app password, Microsoft tenant-admin consent, or no safe handoff.

Azure is Microsoft transport, not a separate password protocol. A mailbox's OAuth or delegation mode for native sending is also separate from its TrulyInbox and EmailGuard handoff.

Inspect the authoritative report

oxygen mailboxes compatibility --json

This is a pure read: it costs 0 credits, never decrypts a credential, and never calls TrulyInbox or EmailGuard.

Hypertide secure handoff file

Import a local agency export with:

oxygen mailboxes import --from hypertide --file ./hypertide-export.json --json

The file may be CSV, JSON, JSONL, or XLSX, up to 500 rows and 5 MB. Common headers such as Email Address, Provider, App Password, SMTP Password, and IMAP Password are normalized locally. Standard Google and Microsoft SMTP/IMAP hosts can identify the provider when the export omits it.

Canonical JSON:

{
  "mailboxes": [
    {
      "email_address": "ada@send-acme.com",
      "provider": "google",
      "app_password": "<Google mailbox app password>"
    }
  ]
}

Only Google rows need an app password. Someone who can sign in to that exact mailbox creates it from the mailbox's Google Account after enabling 2-Step Verification; never export a super-admin credential. Microsoft rows should omit password fields because the CLI discards them locally and TrulyInbox uses interactive Entra tenant-admin consent later.

Import costs 0 Oxygen credits, but it is a state-changing registration with no dry-run. The complete file is parsed and normalized before the first request. Any parse, shape, provider, or credential-conflict error rejects the entire file before the first mailbox write and names the failing row as mailboxes[index]. A later infrastructure failure can interrupt the server upsert; re-run the same file because import is idempotent by mailbox address.

Current supported matrix

This table is the current executable product contract. A pairing omitted from it is not silently inferred or supported. InboxKit Azure appears only under the InboxKit origin because Azure is currently an InboxKit-provisioned infrastructure tier; that describes today's supported contract, not a promise that another origin can never add Azure in the future.

What the states mean

Google Workspace

InboxKit, legacy CMR, Hypertide, and Zapmail can supply a scoped SMTP/IMAP app password just in time after approval. Preview never materializes it. Hypertide transfers are accepted only through the local secure file import, encrypted immediately, and deleted after compatible provider handoffs confirm the same revision.

Manual and native Google rows remain credential_required: Oxygen does not turn its Gmail OAuth refresh token into a third-party password.

Microsoft 365 and Azure

Microsoft warmup never uses a mailbox password:

oxygen mailboxes warmup microsoft --mailboxes ada@send-acme.com --json

The preview returns the TrulyInbox admin-consent URL and costs 0 credits. A tenant administrator completes the browser consent. Oxygen then registers or reuses the exact tenant workspace and syncs only the approved addresses with warmup still disabled. Starting warmup is a separate priced approval.

The TrulyInbox consent cannot be relayed into EmailGuard. Continuous EmailGuard mailbox monitoring is therefore vendor_blocked for Microsoft 365 and InboxKit Azure until EmailGuard exposes a supported OAuth or tenant-consent API.

Cost boundary

• Compatibility inspection: 0 credits, no downstream provider call.
• Hypertide import: 0 credits, but it immediately writes mailbox registrations in Oxygen; no downstream provider call and no dry-run.
• Microsoft consent/workspace sync: 0 credits, explicit approval, warmup remains off.
• TrulyInbox warmup: separately previewed and billed at the displayed per-inbox monthly credit price.
• EmailGuard monitoring: managed mode is 1,000 credits per inbox-month ($1 face value); BYOK is 0 Oxygen credits. Microsoft/Azure is blocked before credential access or billing.

Related

• Integrations — how provider credentials are connected.
• Approvals — previews, exact scope, and approval tokens.
• Billing and credits — how recurring managed services consume credits.