Workspaces for multi-tenant email

Isolate inboxes and domains across your customers without opening a new myagentmail account per customer.

The structure

Tenant (your account, one Stripe subscription)
├── Workspace "Default"
│   └── Your own inboxes + domains
├── Workspace "Acme Corp"      ← reseller customer 1
│   ├── Inboxes
│   └── Domains
└── Workspace "TalentHub"      ← reseller customer 2
    ├── Inboxes
    └── Domains

A workspace is a hard isolation boundary. Inboxes, domains, threads, messages, drafts, and lists all belong to one workspace. A workspace master key (wk_) can only see its own workspace. Your tenant master key (tk_) can see all workspaces across your tenant.

When you need them

• You're building a SaaS that gives each customer their own inbox (recruiter tools, support platforms, sales tools)
• You want to offer custom domains to your customers and each needs its own deliverability posture
• Your customers would be upset if another customer's domain leaked into their dashboard
• You need one billing relationship with us but many tenants of your own underneath

Provisioning a workspace

# 1. Create the workspace (requires your tenant master key)
curl -X POST https://myagentmail.com/v1/workspaces \
  -H "X-API-Key: tk_..." -H "Content-Type: application/json" \
  -d '{"name": "Acme Corp"}'
# → { "id": "81b7be7b-...", "slug": "acme-corp", ... }

# 2. Issue a workspace-scoped key
curl -X POST https://myagentmail.com/v1/workspaces/81b7be7b-.../keys \
  -H "X-API-Key: tk_..." -H "Content-Type: application/json" \
  -d '{"name": "Acme API key"}'
# → { "key": "wk_...", "prefix": "wk_...", ... }

# 3. Hand that wk_ key to Acme's agent runtime

What the scoped key can do

A wk_ key behaves like a tenant master key, but every list, create, update, and delete is scoped to its workspace. If Acme's agent tries to create an inbox, it lands in Acme's workspace automatically. If it tries to list inboxes, it sees only its workspace. Cross-workspace access is impossible at the API layer.

Billing

Billing lives at the tenant level. Your plan limits (inboxes / emails / domains) are tenant-wide totals that roll up across all workspaces. If you want per-workspace usage visibility, hit GET /v1/metrics?workspace=<id> to get scoped counters.