VerifiedInbox for AI agents and assistants

In one sentence: VerifiedInbox lets an AI assistant take a company's email domain all the way to its logo, and Gmail's blue verified checkmark, shown next to the company's emails, while the person only steps in to pay, edit DNS records and approve their logo.

If you are an agent about to do the work, read the complete guide: get-started.md (also as a web page). It contains every step, tool name, error and rule.

Why this exists#

When a company sends email, most inboxes show a plain letter next to its name. With the right setup (a standard called BIMI plus a mark certificate), Gmail and other inboxes show the company's real logo instead, and with a Verified Mark Certificate, Gmail adds a blue checkmark. Getting there normally takes weeks of back-and-forth: email security settings, a special logo file format, trademark evidence, business verification, a certificate order, DNS records, hosting, and a renewal every year.

VerifiedInbox does all of it as a single service, and it was built AI-first: every operation in the web app is also an API call and an MCP tool, the server keeps all state, and every response tells the caller what to do next.

Who you are helping#

Mostly non-technical people: marketing managers, sales leaders and founders who want their brand recognized in the inbox and want customers to trust their emails. Talk to them in plain English. Many will paste a single sentence into their assistant, for example:

Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md

What you can do#

Signed-in users can use test mode (sandbox): the whole flow without charges or real certificates.

Boundaries (by design)#

• Agents cannot pay. You can create a Stripe checkout link; only the person can complete it.
• Agents do not change DNS. You give exact records; the person or their IT adds them. We verify within seconds.
• The person approves the logo. Approval is tied to the exact file they reviewed.
• Revocation needs an explicit confirmation string (REVOKE <domain>) and the certificates:write scope.
• No access by guessing. Knowing a domain or an application id grants nothing; inaccessible resources return 404.
• Shared email domains (gmail.com, outlook.com, icloud.com, …) cannot be used; the person needs their own domain.

Connect#

• MCP server: https://api.getverifiedinbox.com/mcp (Streamable HTTP). Connect anonymously to start; sign in with OAuth (WorkOS) or use an API key (vi_live_… / vi_test_…) for account tools. Setup for Claude, ChatGPT, Cursor and Claude Code: get-started.md → Connect.
• REST API: https://api.getverifiedinbox.com/v1 — API reference.
• OpenAPI 3.1 schema: https://getverifiedinbox.com/openapi.json (also at https://api.getverifiedinbox.com/openapi.json). The complete REST contract; the MCP tools' arguments are generated from it. Each operation says who may call it (x-access), whether it needs an Idempotency-Key (x-idempotency) and which MCP tool does the same thing (x-mcp-tools).
• MCP reference: all tools.
• Markdown everywhere: every page on this site has a markdown version at the same URL plus .md (for example /pricing.md), and requests with Accept: text/markdown get markdown too. Index: /llms.txt · everything in one file: /llms-full.txt.

The outcomes to report#

Keep these separate when you talk to the person; they are tracked separately by the API:

1. Eligibility assessed — VMC (logo + checkmark), CMC (logo only) or not currently eligible.
2. Certificate issued — by the certificate issuer (DigiCert).
3. BIMI published — the DNS record and hosted files are live and correct.
4. Display observed — the person saw the logo (and checkmark, for VMC) in a real Gmail inbox.

Pricing, in brief#

Free checker. CMC $899 and VMC $1,499 per domain per year, including business verification, logo preparation, certificate ordering, hosting, monitoring, automatic renewals and support. The certificate issuer's own fee (about $750–$1,750 per year) is separate, passed through without markup and shown before payment. Full refund if the issuer rejects the application. Details: pricing.

Guidelines for assistants#

1. Use plain language; offer technical detail only when asked.
2. Never say the checkmark or logo display is guaranteed; Gmail decides what to show.
3. Never ask for passwords, card numbers or DNS-provider logins.
4. Confirm with the person before creating a checkout, attesting authority, approving a logo or revoking a certificate.
5. Save the application_id and guest_token so you can continue in a later conversation.
6. Follow next_actions in every response.
7. If the person wants a human, use contact_support with kind: "contact_human".