NoovexOS API

1. Check a handle (open, no key)

GET https://noovexmail.online/api/public/v1/addresses?handle=lovable
→ { "address": "lovable@noovexmail.online", "available": true }

2. Create an account from NoovexOS

POST https://noovexmail.online/api/public/v1/accounts
Content-Type: application/json

{
  "first_name": "Mr",
  "last_name": "VonKoch",
  "handle": "vonkoch",
  "email": "you@example.com",
  "password": "at-least-8-chars",
  "device_name": "NoovexOS laptop"
}

→ 201 { "account": { "address": "vonkoch@noovexmail.online", ... }, "api_key": "nvx_..." }

3. Get a key for an existing account

POST https://noovexmail.online/api/public/v1/keys
{ "email": "you@example.com", "password": "…", "device_name": "NoovexOS" }
→ 201 { "api_key": "nvx_..." }

4. Send mail to Gmail (or anywhere)

POST https://noovexmail.online/api/public/v1/messages
Authorization: Bearer nvx_your_key
Content-Type: application/json

{ "to": "someone@gmail.com", "subject": "Hi from NoovexOS", "body": "It works." }

→ 201 { "message": { "id": "…", "delivery": "external", "delivered": true } }

5. Read the mailbox

GET https://noovexmail.online/api/public/v1/messages?folder=inbox&limit=50
Authorization: Bearer nvx_your_key

GET https://noovexmail.online/api/public/v1/me   → account details + unread count

6. Receive replies (inbound webhook)

Point your inbound mail provider (Cloudflare Email Routing, Mailgun or Postmark inbound route) at this endpoint and replies from Gmail land in the member's Noovex inbox.

POST https://noovexmail.online/api/public/v1/inbound
x-inbound-secret: <INBOUND_MAIL_SECRET>
Content-Type: application/json

{ "from": "Someone <someone@gmail.com>",
  "to": "lovable@noovexmail.online",
  "subject": "Re: Hi from NoovexOS",
  "text": "Got it!" }

→ 201 { "received": true, "id": "…" }

7. Sign in with Noovex (OAuth 2.0 + PKCE)

Noovex runs its own OAuth server, so NoovexOS — or any other app — can let people sign in with their Noovex account instead of a third-party provider. Users approve the request on the Noovex consent screen at https://noovexmail.online/.lovable/oauth/consent, and your app receives a user-scoped access token.

Discover every endpoint (authorize, token, JWKS, dynamic client registration) from the Noovex authorization server metadata:

GET https://atyfubnzdjxrypnpedkd.supabase.co/auth/v1/.well-known/oauth-authorization-server
→ { "issuer": "...", "authorization_endpoint": "...", "token_endpoint": "...",
    "jwks_uri": "...", "registration_endpoint": "..." }

Then run the standard code flow:

# 1. register your client once (or create it in Noovex settings)
POST <registration_endpoint>
{ "client_name": "NoovexOS", "redirect_uris": ["noovexos://auth/callback"] }

# 2. send the user to authorize (PKCE)
GET <authorization_endpoint>
  ?response_type=code
  &client_id=<client_id>
  &redirect_uri=noovexos://auth/callback
  &scope=openid%20email%20profile
  &code_challenge=<S256 challenge>&code_challenge_method=S256
  &state=<random>

# → the user lands on https://noovexmail.online/.lovable/oauth/consent and approves
# → Noovex redirects to noovexos://auth/callback?code=…&state=…

# 3. exchange the code for tokens
POST <token_endpoint>
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=<code>&redirect_uri=noovexos://auth/callback
&client_id=<client_id>&code_verifier=<verifier>

→ { "access_token": "…", "refresh_token": "…", "expires_in": 3600 }

Use the access token as a bearer token against Noovex endpoints that act as the signed-in user, and verify it against the jwks_uri above.