QuoxCLIQuoxCLIInboxQTerminal
Managing email accounts from the Quox CLI
Adam Cowles2026-10-10T09:00:00.000Z4 min read
The mailbox your agents read is one of the most sensitive things you will ever connect. So the command that connects it should put the password somewhere you can account for, and never on the command line.
This is the first in a short series on things you can actually do from the Quox command line. No dashboard, no clicking through a settings page, just the terminal and a governed result at the end of it. We are starting with something small and real: managing the email accounts that InboxQ triages for you.
InboxQ is the part of Quox that connects a mailbox, syncs it, and sorts what arrives into zones your agents can act on. Before any of that happens, something has to connect the account. Here is the whole flow from a prompt.
See what is already connected
Start by signing in with a human profile and picking the org you are working in. The human profile matters, and we will come back to why in a moment. Then list the mailboxes this org already has, and remove any you no longer want. Every command keys off the account id you see in the listing.
# sign in with a human profile, then pick your org quox -p admin login quox org switch acme # list the mailboxes this org already has connected quox mail accounts ID ADDRESS POLLING acct_7Q2F [email protected] yes acct_3K8M [email protected] yes # remove one by its id quox mail disconnect acct_7Q2F Disconnected acct_7Q2F. Sync stopped; the mailbox itself is untouched.
Connect a new mailbox in one governed step
Now the useful part. Connecting a mailbox usually means handing a password to a settings form and hoping it ends up somewhere sensible. From the CLI it is one command, and the password is handled deliberately: you read it into an environment variable, point connect at the variable by name rather than passing the value, then clear it.
# read the password into an env var so it never hits your shell history read -s -p "IMAP password: " MAILPW; export MAILPW # point connect at the variable by name, not the value quox mail connect \ --email [email protected] \ --imap-host imap.example.com \ --smtp-host smtp.example.com \ --password-env MAILPW \ --label "Acme ops inbox" \ --name "Ops" Connected [email protected] (acct_9F4T). Minted credential cred_01M4HBQ048 in QuoxVault; the account references it. # clear the password from the environment unset MAILPW
That single connect did two things. It minted a credential in QuoxVault from the password it read out of MAILPW, and it connected the mailbox to reference that credential. From then on the account points at the credential id; the password itself is held encrypted in the vault, not in the account record and not in any log. Here is the whole path the password takes.
Why it insisted on a human profile
This is the detail worth slowing down on. Creating a credential writes a secret, and Quox will not let a background agent do that silently. Connecting a mailbox inline needs a profile with secrets-write permission, which in practice means a human signed in, which is why the first command was quox -p admin login and not the resident agent identity. An agent can use a credential that already exists (--credential <id> reuses a stored one), but minting a new one is a human action, on purpose.
If you already have the account connected and the credential stored, the agents take it from there. They sync the mailbox, triage what arrives into zones, and raise proposals (file this, block that, draft a reply) for a human to approve. InboxQ reads and sorts and suggests; it does not send mail on its own. The approval step is the point, not a limitation.
The shape of every piece in this series
Notice what the terminal gave you that a settings page does not. The password went into the vault through a named variable you controlled, the account came out referencing a credential id you can audit, and the one action that creates a secret was gated to a human. That is the same shape across the whole CLI: the convenient thing and the governed thing are the same command, so you do not have to choose between moving fast and being able to account for what happened.
If you want the product context, the InboxQ page covers what the triage actually does with a connected mailbox, and the CLI reference lists the full quox command surface. Next in the series we will take a different corner of it. For now, that is one real thing you can do from the Quox command line, start to finish, without leaving the terminal.