{"slug": "verification-codes-for-ai-agents", "title": "Verification codes for AI agents", "summary": "Patrick, founder of Pidgeon, built an email API that lets AI agents obtain their own persistent addresses and wait for verification codes without polling. The await endpoint holds a request open for up to 280 seconds and returns the message with codes and confirmation links already extracted, filtering out codes quoted from earlier emails and mail that fails DMARC. Pidgeon also ships an MCP server tool, TypeScript and Python SDKs, a CLI, and a Browser Use-based signup-agent example that creates an address, completes a sign-up, and later handles a password reset at the same address.", "body_md": "*Cross-posted from the [Pidgeon blog](https://pidgeon.ai/blog/verification-codes-for-ai-agents). I'm Patrick, founder of Pidgeon.*\n\nYour agent can fill in the sign-up form. This is how it gets the code that comes back: an address of its own, one call that waits for the email, and the code already pulled out of it.\n\nAn agent can fill in a sign-up form. The trouble starts a second later, when the service emails a six-digit code to the address on the form. If that address is yours, a person has to fetch the code. If it is a throwaway, the code arrives, but so will every email that account sends afterwards, the login codes, the password reset and the receipts, at an address nobody is reading.\n\nWith Pidgeon the agent signs up with an address of its own and keeps it. The first code arrives there, and so does everything after it.\n\nThe agent asks for the code before it submits the form, and the answer comes back when the email does:\n\n```\ncurl -G https://pidgeon.ai/api/v1/messages/await \\\n  -H \"Authorization: Bearer $PIDGEON_API_KEY\" \\\n  -d identity_id=$IDENTITY_ID \\\n  -d has_code=true \\\n  -d timeout=120\n```\n\nThe request holds open for up to 280 seconds. What comes back is the message with the code already pulled out of it: `extracted.codes`, most likely first, and `extracted.links` with the confirmation link at the top. There is no polling loop to write, and no regex for whichever format this service uses.\n\nFrom an agent it is the same call: the MCP server's `await_message` tool takes the same parameters, and so do `messagesAwait` in the [TypeScript SDK](https://pidgeon.ai/docs/sdks), `messages_await` in Python, and the [CLI](https://pidgeon.ai/docs/cli).\n\nFinding a code in an email is a guess, and a careless guess is a security problem. Pidgeon makes it carefully:\n\n**Codes are read from the new text only.** A code quoted from an earlier email in the thread is never offered again.\n\n**A forged sender is not the service.** Anyone can type `no-reply@github.com` into a From line. When the agent waits for mail from a sender, only mail that passed DMARC counts; a forgery is set aside and counted, not returned.\n\n**Nothing is lost quietly.** Mail filed as spam, or a match that failed authentication, comes back as a count with its id, so the agent can tell \"the code never came\" from \"the code came and was held\".\n\n**Every message comes with a Firewall verdict.** [Pidgeon Firewall](https://pidgeon.ai/firewall) names hidden text, instructions addressed to an AI and look-alike senders, so your agent can check the email before it acts on the code. A sign-up email is an email from a stranger, and it gets the same check as any other.\n\n[`signup-agent`](https://github.com/pidgeon-ai/pidgeon-examples/tree/main/signup-agent) is a browser agent built on Browser Use and the Pidgeon Python SDK. It creates its own address, fills in a sign-up page, waits for the code, types it in and is signed in. Then it asks for a password reset, and the reset link arrives at the same address, because the address is still its own. It runs in our CI.\n\n[Sign up](https://pidgeon.ai/signup?utm_source=devto&utm_medium=crosspost&utm_campaign=launch-week), create an address, and point the wait at it. The [verification codes guide](https://pidgeon.ai/docs/verification-codes) has every parameter, and the [quickstart](https://pidgeon.ai/docs/quickstart) takes about five minutes. Or paste one line into your coding agent:\n\n```\nRead pidgeon.ai/skill.md and get yourself an email address.\n```\n\n", "url": "https://wpnews.pro/news/verification-codes-for-ai-agents", "canonical_source": "https://dev.to/patrickcneuhaus/verification-codes-for-ai-agents-4ef", "published_at": "2026-10-26 13:07:36+00:00", "updated_at": "2026-10-26 13:14:20.300312+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "agent-protocols", "ai-safety"], "entities": ["Pidgeon", "Patrick", "Browser Use", "GitHub", "Pidgeon Firewall"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/verification-codes-for-ai-agents", "markdown": "https://wpnews.pro/news/verification-codes-for-ai-agents.md", "text": "https://wpnews.pro/news/verification-codes-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/verification-codes-for-ai-agents.jsonld"}}