Automations

What automations do

An automation watches one address: a mailbox, an alias or a group. When a new email arrives there and matches the conditions you set, it runs up to five actions.

• Open Automations in your admin console. Owners and admins of the account can set them up.
• Automations run for new mail that isn’t marked as junk. Your mail is delivered as usual either way.
• They can’t be set up in the live demo, because they read a real mailbox and send messages outside the demo.

Included in every plan

Automations are included, with a number of runs each month for each account. Each automation that runs for an email is one run, so an email that starts two automations uses two. Tests and Run again don’t count.

• Runs this month, on the Automations page, shows what you’ve used. A new month starts on the 1st at midnight UTC.
• Over the limit, new emails don’t start automations until the 1st of next month. They’re logged as Skipped: monthly limit and don’t run later. Your mail keeps arriving as usual.
• Each automation sends at most 50 forwards and 50 automatic replies an hour. One that reaches 50 forwards in an hour is turned off, because that usually means a mail loop, and we email your account’s contact address. Replies over the hourly limit are skipped.
• An account can have up to 50 automations, each with up to five actions.
• If your email comes through a partner, the limit follows the storage they give your account.

Connect a mailbox

To see an email’s sender, subject, text and attachments, and to forward, reply or file it, an automation reads the mailbox the email arrives in. The first time you use a mailbox, you connect it:

1. In the automation, pick the address. If its mailbox isn’t connected yet, you see Connect followed by the mailbox’s address.
2. Enter that mailbox’s password. If the mailbox uses two-step sign-in, you’re also asked for a current 6-digit code from its authenticator app.
3. Choose Connect mailbox. When the page says the mailbox is connected, you can save the automation.

Here’s exactly what happens. The password goes, encrypted, to our automation service, which uses it once: to sign in as the mailbox and create an app password for it named Automations. Then the password is deleted. We don’t keep it. This app password, the mailbox’s key:

• can read the mailbox’s mail, file it in folders and send mail as the mailbox. Our automation service uses it only for the actions you set up, and the forwards and replies it sends are kept in the mailbox’s sent mail;
• can’t delete mail or change the mailbox’s password;
• works only from our automation service, so nobody can use it to sign in to webmail or a mail app;
• is stored encrypted, and only the automation service can open it.

These changes cut automations off from a mailbox. Its automations stop and show Reconnect mailbox, and we email your account’s contact address:

• A new password set in the console, under Users, or through a setup, reset or password-help link: the key is removed. Connect the mailbox again with the new password.
• The key removed in webmail: the person who uses the mailbox sees it under Settings, then Security, then App passwords, and can remove it. Connect the mailbox again to carry on.
• Deleting the mailbox: the key is removed and the automations that read it are turned off. If you restore the mailbox, connect it again and turn them back on.

A password changed anywhere else, such as in webmail, doesn’t remove the key. To cut automations off from a mailbox, disconnect it (below). While a mailbox is suspended, automations that read it don’t run, and they don’t catch up on the mail that arrived meanwhile. Once it’s resumed, they start again by themselves.

To disconnect a mailbox, use Disconnect under Connections on the Automations page. Every automation that reads it is turned off, and its key is removed. Deleting the last automation that reads a mailbox removes the key too.

Start from a recipe

Recipes are ready-made automations. On the Automations page, pick one under Pick a recipe or Start another, then fill in two or three things. If your account has a matching address, such as sales@ or accounts@, the recipe picks it for you. Every new automation starts turned off, so you can test it first.

Ping your team on Telegram for every website enquiry

1. Pick the address your enquiries come to, and connect its mailbox if you’re asked.
2. Under Message on Telegram, paste your bot’s token and choose Check. Send /start to the bot, or add it to your team’s group, then choose Find my chat and pick the chat. See Telegram.
3. Choose Save, then Test on the last matching email. When the message shows up in Telegram, choose Turn on.

Reply to every enquiry automatically

1. Pick the address and connect its mailbox if you’re asked.
2. Change the Subject and the Reply to suit you. You can use {{from_name}}, {{from_email}}, {{subject}} and {{to}}. Choose how often the same sender may get it: at most once every 1 to 30 days.
3. Choose Save and test it: the test shows who would get the reply, without sending it. Then choose Turn on.

Post new enquiries in a Slack channel

1. Pick the address and connect its mailbox if you’re asked.
2. Paste the channel’s incoming webhook address. See Slack.
3. Choose Save, test it, then choose Turn on.

Send vendor invoices (PDF) to your accountant

1. Pick the address your invoices come to, such as accounts@, and connect its mailbox if you’re asked. Only emails with a PDF attached start this automation.
2. Enter your accountant’s address under Forward to. Each invoice is also filed in an Invoices folder: change the folder’s name, or choose Move it out of the inbox, if you like.
3. Choose Save and test it: the test shows where the email would be forwarded and filed, without sending or moving anything. Then choose Turn on.

Alert the team about new orders and payments

1. Pick the address your shop, marketplace or payment provider writes to, and connect its mailbox if you’re asked.
2. Under Only when, enter the domain those emails come from under Sender’s domain is, such as your shop’s or your payment provider’s. Every condition you fill in must match, so add a word under Subject contains only if all those emails have it.
3. Set up Message on Telegram as in the first recipe, then save, test and turn it on.

Send every email to Zapier, Pabbly, Make or n8n

1. Pick the address and connect its mailbox if you’re asked.
2. Paste your tool’s catch-hook address and choose Save. Copy the signing secret that appears: it’s shown only once.
3. Test it, so your tool receives a sample email, finish your workflow there, then choose Turn on. See Zapier, Pabbly Connect, Make or n8n.

Build your own

Choose Build your own to pick the address, the conditions and up to five actions yourself.

1. When an email arrives: give the automation a name and pick the address under At this address. Your mailboxes, aliases and groups are listed.
2. Only when: add conditions if you want them. Every condition you fill in must match, and capital letters don’t matter.
3. Do this: add actions with Add an action. Each action runs on its own, so one that fails doesn’t stop the others.
4. Choose Save. Then test it and turn it on.

Aliases and groups

• An alias delivers to a mailbox, and the automation reads that mailbox, so that’s the one to connect.
• A group gives each member a copy. Under Read the copy in, pick whose copy the automation reads, and connect that mailbox. The automation runs once per email, when the group’s address is in To or Cc: a group address that was only in Bcc isn’t seen. Replies come from that member’s mailbox, with answers going to the group, and filing applies to that member’s copy.

How the actions behave

• Forward the email sends a plain-text copy, with up to 100,000 characters of its text and with its attachments, from the connected mailbox, and keeps it in that mailbox’s sent mail. It never forwards mail that another automation sent, bounces and delivery reports, or automatic replies, so two automations can’t send an email back and forth. The run log says why a forward was skipped.
• Reply automatically answers in plain text, in the same conversation, from the address the email was sent to. It replies to the same sender at most once in the number of days you chose, and never to newsletters and mailing lists, bounces, no-reply and other automatic senders, mail from an automation, or your own domains.
• Add a label or move to a folder creates the folder if it doesn’t exist yet. Use a folder of your own, not Inbox, Sent, Drafts, Trash, Junk or Archive.
• Forwards and automatic replies are sent from the mailbox like any other mail, so your sending limits apply to them. While sending is paused for the account or the mailbox, they aren’t sent and the run shows why: once it can send again, choose Run again on the run.

Telegram: use your own bot

Telegram messages come from a bot that you create and own, so they carry your bot’s name. Making one is free.

1. In Telegram, open @BotFather (it has a blue tick) and send /newbot.
2. Choose a name people will see, such as “Sales alerts”, then a username that ends in “bot”, such as yourcompany_sales_bot. BotFather replies with a token: digits, a colon and a long code, such as 123456789:AAE…
3. In your automation, under Message on Telegram, paste the token and choose Check. The page shows the bot it found.
4. Choose where the messages go:
   • To yourself: open your new bot in Telegram and choose Start, or send it /start.
   • To your team: add the bot to your team’s group, like any other member, and send a message in the group.
5. Back in the automation, choose Find my chat and pick the chat under Post to. Then save, test and turn it on.

Each message says which address the email came to, who sent it, the subject, any attachment names and the first lines of the text. Test messages start with “Test:”.

• Your group isn’t listed? In the group, send /start@ followed by your bot’s username, such as /start@yourcompany_sales_bot, then choose Find my chat again. Telegram keeps these messages for the bot for about a day, so find the chat soon after.
• Use a new bot made just for this. A bot that’s already connected to another service may not show its chats.
• Keep the token private: anyone who has it can post as your bot. If it leaks, send /revoke to BotFather, then paste the new token into the automation.
• The run log says the group was upgraded? Telegram moved the group to a new address. Paste the token again, find the chat again and save.

Slack: post to a channel

Slack messages arrive through an incoming webhook: a private address that posts to one channel.

1. In Slack’s app settings, at api.slack.com/apps, create a new app from scratch. Give it a name, such as “Email alerts”, and pick your workspace.
2. Open Incoming Webhooks, turn on Activate Incoming Webhooks, then choose Add New Webhook to Workspace and pick the channel. For a private channel, you need to be a member of it first.
3. Copy the webhook URL, which starts with https://hooks.slack.com/services/, and paste it under Incoming webhook address in your automation. Then save, test and turn it on.

• An address from Slack’s older Incoming WebHooks app works too.
• If your workspace needs approval for new apps, ask a workspace admin.
• Treat the address like a password: anyone who has it can post in the channel. If it’s removed in Slack, the action fails until you paste a new one.

Zapier, Pabbly Connect, Make or n8n

Send to a webhook passes each matching email to the tool you already use, as a JSON message. From there, your tool can update a spreadsheet or your CRM, alert someone, or anything else it can do.

1. In your tool, start a new workflow with its webhook trigger: the one that gives you an address to receive data, such as Catch Hook in Webhooks by Zapier or Custom webhook in Make. Copy the address.
2. In your automation, add Send to a webhook, paste the address under Catch-hook address and choose Save. Copy the signing secret that appears: it’s shown only once.
3. Choose Test on the last matching email, so your tool receives a sample and learns its fields. Finish the workflow in your tool, then choose Turn on.

• In n8n, use your Webhook node’s production URL, then save and publish (activate) the workflow. Its test URL works only while the editor is listening for a test event.
• The address must be a public https:// address. Redirects aren’t followed, so paste the final address.
• These tools accept the message without checking its signature. If you receive it with your own code, check the signature.
• Some tools need a paid plan of their own for webhook triggers.

For developers: the webhook message

Each matching email is sent as one HTTPS POST with a JSON body of up to 256 KB, like this:

{
  "event": "email.received",
  "id": "3f6c2a1e-7d4b-4a8e-9c2f-1b5d6e7f8a90.0",
  "test": false,
  "automation": {
    "id": "8d1e5b7c-2f3a-4c6d-9e8f-0a1b2c3d4e5f",
    "name": "Emails to my workflow tool"
  },
  "address": "sales@yourcompany.com",
  "received_at": "2026-10-16T09:41:07Z",
  "message_id": "CAF1x9Lq8mZ@mail.example.com",
  "from": { "name": "Priya Sharma", "email": "priya@example.com" },
  "reply_to": null,
  "to": [{ "name": null, "email": "sales@yourcompany.com" }],
  "cc": [],
  "subject": "Quote for 12 desks",
  "preview": "Hi, could you send us a quote for 12 desks?",
  "text": "Hi, could you send us a quote for 12 desks?\n\nThanks,\nPriya",
  "size": 18234,
  "has_attachments": true,
  "attachments": [
    { "name": "floor-plan.pdf", "type": "application/pdf", "size": 120044 }
  ]
}

• id stays the same when a delivery is tried again, and also comes in the X-Webhook-Id header. Use it to ignore repeats.
• test is true for tests.
• text is the email’s plain text, up to 100,000 characters, and shorter if needed so the message stays under 256 KB. attachments lists up to 50 files by name, type and size, fewer for a very large message; the files themselves aren’t sent.
• Times are in UTC.

Check the signature

The X-Webhook-Signature header looks like ts=1760607667;h1=5f2c…. The h1 value is the HMAC-SHA256, in hex, of the ts value, a colon and the raw body, made with your signing secret: the whole value that starts with whsec_. To check a message:

1. Read the raw body bytes, before any JSON parsing.
2. Compute the HMAC-SHA256 of ts + : + the raw body with your secret, in hex, and compare it with h1 in constant time.
3. Refuse the message if ts is more than 5 minutes away from your clock, so an old message can’t be replayed.

Node.js 18 or later, with Express:

import crypto from "node:crypto";
import express from "express";

// the whsec_… secret shown when you saved the action
const SECRET = process.env.WEBHOOK_SECRET;

function verifySignature(rawBody, header, secret, toleranceSeconds = 300) {
  if (!header) return false;
  let ts = "";
  const signatures = [];
  for (const part of header.split(";")) {
    const i = part.indexOf("=");
    if (i < 0) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === "ts") ts = value;
    else if (key === "h1") signatures.push(value);
  }
  if (!/^\d+$/.test(ts) || signatures.length === 0) return false;
  // too old: it could be a replay
  if (Math.abs(Date.now() / 1000 - Number(ts)) > toleranceSeconds) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${ts}:`).update(rawBody).digest("hex");
  return signatures.some((s) => s.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)));
}

const app = express();
// keep the raw bytes: the signature covers them exactly (up to 256 KB)
const rawJson = express.raw({ type: "application/json", limit: "300kb" });

app.post("/email-received", rawJson, (req, res) => {
  const header = req.get("X-Webhook-Signature");
  if (!Buffer.isBuffer(req.body) || !verifySignature(req.body, header, SECRET)) {
    return res.sendStatus(401);
  }
  const email = JSON.parse(req.body.toString("utf8"));
  // email.id is the same on every retry: skip it if it was handled already
  console.log(email.from?.email, email.subject);
  res.sendStatus(204);
});

app.listen(3000);

Python 3.8 or later, with Flask 2 or later:

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

# the whsec_… secret shown when you saved the action
SECRET = os.environ["WEBHOOK_SECRET"]


def verify_signature(raw_body, header, secret, tolerance_seconds=300):
    if not header:
        return False
    ts, signatures = "", []
    for part in header.split(";"):
        key, sep, value = part.partition("=")
        if not sep:
            continue
        key, value = key.strip(), value.strip()
        if key == "ts":
            ts = value
        elif key == "h1":
            signatures.append(value)
    if not (ts.isascii() and ts.isdigit()) or not signatures:
        return False
    if abs(time.time() - int(ts)) > tolerance_seconds:  # too old: a replay?
        return False
    message = ts.encode() + b":" + raw_body
    expected = hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(s.encode(), expected.encode())
               for s in signatures)


app = Flask(__name__)


@app.post("/email-received")
def email_received():
    raw = request.get_data()  # the raw bytes: the signature covers them exactly
    header = request.headers.get("X-Webhook-Signature")
    if not verify_signature(raw, header, SECRET):
        abort(401)
    email = json.loads(raw)
    # email["id"] is the same on every retry: skip it if it was handled already
    print((email["from"] or {}).get("email"), email["subject"])
    return "", 204

Answers and retries

• Answer with any 2xx status within 10 seconds. What you send back is ignored, so answer first and do slow work afterwards.
• No answer, a network error, or the status 408, 425, 429 or any 5xx: we try again after 1, 5, 30 and 120 minutes.
• Any other status, including a redirect, fails at once. The run log shows the status you sent.
• Messages can arrive in a different order from the emails.
• Lost the signing secret? Remove the webhook action, add it again and save: you get a new secret.

Test, turn on and make changes

• Test on the last matching email runs the automation on the newest matching email among the latest 50 in the inbox of the connected mailbox. Telegram and Slack messages and webhooks really go out, marked as a test: Telegram and Slack messages start with “Test:”, and webhook messages say "test": true. Forwards, replies and filing are only shown as a preview. You can test while the automation is off, and tests don’t count towards your runs.
• Turn on makes it run for every new email that matches. It doesn’t run for mail that arrived before.
• Turn off stops it until you turn it on again.
• Changes you save apply from the next email.
• Delete this automation stops it at once. Your mail isn’t affected.

The run log

Each automation’s page lists its latest 20 runs under Recent runs: when each one started, the sender, the subject and how each action went. Runs are kept for 30 days.

An action that fails is tried again after 1, 5, 30 and 120 minutes, and shows Retrying in between. If it still fails, or fails in a way that trying again can’t fix, we email your account’s contact address, at most once every 6 hours for each automation. Fix the cause, then choose Run again on the run: only the failed actions run again, on the same email.

Troubleshooting

Privacy and safety

• Automations read mail only when it arrives in a connected mailbox while an automation that reads it is on, or when you test one, to check the conditions and run the actions. We don’t keep the emails.
• The run log keeps, for 30 days, when each run happened, the email’s message ID, the sender’s address, the start of the subject and each action’s result, such as the address a forward or reply went to. It never keeps the email itself.
• What an action sends leaves our service. Telegram and Slack get the sender, the subject, attachment names and the first lines of the text. Webhooks get the sender and recipients, the subject, up to 100,000 characters of the text and the attachment names. These services are your choice, and their own terms apply.
• Bot tokens, webhook addresses, signing secrets and mailbox keys are stored encrypted. The console never shows them again, only a hint such as the bot’s name.
• Connecting or disconnecting a mailbox, and every change to an automation, is recorded in our audit log.
• Our support team can pause an account’s automations, for example to stop abuse. Mail keeps arriving as usual, and the Automations page says so.

Related: Connect an AI assistant · App passwords · Aliases and groups · Storage and limits

Product names are trademarks of their owners. Patra isn’t affiliated with them.