Inbound Email Simplified
Turn inbound email into a reliable data stream your app can trust. Provision unique email addresses via API, receive clean JSON payloads at your webhook, and scale safely with SOC 2 practices and no long‑term content storage.
Inbound‑first email processing that turns any message into structured JSON — streamed to your webhook in real time.
Create
Provision a unique inbound address on demand. Every address ships with its own secret and own webhook so you don't need routing glue code.
Stream
Incoming messages are parsed and streamed as JSON to your endpoint — headers, text, HTML, attachments, DKIM/SPF verdicts, spam score, and optional enrichment.
Secure
Reject‑unknown at RCPT TO (no "trash later"), HMAC‑signed webhooks, TLS‑only transport, no long‑term content storage. Metadata‑only logs for audits.
Scale
Multi‑region MX, bounded retries with jitter, concurrency controls, and throughput that grows with your workload — without re‑architecting your app.
Why Developers Choose MERU
Inbound‑only focus
Less complexity, faster time‑to‑value. We specialize in receiving email, not sending it — no SMTP complications or delivery reputation management.
Clean JSON contract
No MIME wrangling, fewer edge cases. Get structured data every time with guaranteed UTF‑8 normalization and optional HTML sanitization.
Compliance by design
SOC 2 alignment, short‑lived spools, delete‑on‑delivery. Built for teams that need enterprise security without the enterprise complexity.
Industries We Support
If your workflow starts in an inbox and ends in an app, MERU is the bridge. Developers across industries trust our inbound email API to power their integrations.
MERU is designed to turn email into reliable data streams.
Instant Address Provisioning
POST https://api.meruhook.com/v1/addresses
{
"webhook_url": "https://yourapp.com/webhook",
"is_permanent": true,
"description": "Customer support emails"
}
Response:
{
"id": "addr_abc123",
"address": "user123@inbound.meruhook.com",
"webhook_secret": "whsec_def456ghi789"
}Per‑Address Webhooks
// One address → one webhook URL
webhook_url: "https://app.com/webhook"
// HMAC SHA-256 signatures with replay protection
Meru-Signature: v1,t=1693123456,s=abc123def456...
// Each address gets unique webhook secret
webhook_secret: "whsec_..."Structured JSON Payloads
{
"event_id": "evt_abc123def456",
"address_id": "addr_abc123",
"timestamp": "2025-09-05T10:30:00Z",
"envelope": {
"mail_from": "sender@example.com",
"rcpt_to": ["user123@inbound.meruhook.com"]
},
"headers": {
"from": "John Doe <sender@example.com>",
"subject": "Customer Support Request"
},
"content": {
"text": "Email body text",
"html": "<p>Email body HTML</p>"
},
"attachments": [
{
"filename": "document.pdf",
"content_type": "application/pdf",
"size_bytes": 1024,
"content": "base64..."
}
],
"spam": {
"score": 0.3,
"verdict": "not_spam"
}
}Security & Compliance
// Reject unknown recipients at SMTP time (pre-DATA)
// TLS enforced; disk encryption for transient spools
// No long-term content storage
// Metadata-only logs (configurable 7–30 days)
550 5.1.1 Recipient not foundReliability & Scaling
// Exponential backoff retries (5xx/timeouts only)
Retry-After: 30s, 60s, 120s, 240s...
// Multi-region MX with failover
mx1.example.com (priority 10)
mx2.example.com (priority 20)
// Per-destination circuit breakersSmart Pipelines
{
"spam": {
"score": 0.3,
"verdict": "not_spam",
"details": {
"spf": "pass",
"dkim": "pass",
"dmarc": "pass"
}
},
"metadata": {
"received_at": "2025-09-05T10:30:00Z",
"processing_time_ms": 156,
"retry_count": 0
}
}Observability
// Usage tracking
GET https://api.meruhook.com/v1/usage
{
"emails": {
"total": 1250,
"successful": 1200,
"failed": 50
},
"webhooks": {
"delivered": 1180,
"failed": 70,
"retrying": 0
},
"success_rate": 96.0
}
// Event-level audit trails availableDeveloper Experience
// Clear docs, SDKs, copy-paste snippets
npm install @meru/webhook-sdk
const webhook = new MeruWebhook(secret);
const payload = webhook.verify(body, signature);
// Language-specific one-pagers and examplesAccess Controls
// API token management
POST https://api.meruhook.com/v1/account/tokens
{
"name": "Production API",
"permissions": ["addresses:read", "addresses:write"]
}
// Usage audit trails
GET https://api.meruhook.com/v1/usage/events
// Per-address TTL & rate limits built-inIntegrations
// First-class webhook support
// Zapier, Make, n8n automation triggers
{
"attachments": [
{
"presigned_url": "https://s3.amazonaws.com/...",
"expires_at": "2024-01-01T12:00:00Z"
}
]
}
// Datadog & OpenTelemetry events