Interactive Mail sessions
The Mail application uses Lucion Identity through its configured OIDC authorization-code and PKCE flow. Session cookies are server-managed and protected by the existing encrypted-session design. Browser API-key authentication is not supported and CORS access is not enabled.
Server integration keys
Server integrations send `Authorization: Bearer <key>` over HTTPS. The server hashes the submitted value, looks up an active matching verifier, checks expiry/revocation/scope, applies key-specific limits, and then binds the request to its stored Mail account. Caller-supplied account identifiers do not change the binding.
Verified email requirement
Creating a key uses the signed-in Identity session and requires `email_verified = true` because Mail sends a security alert. This requirement applies to key creation; API calls themselves use the key’s stored status and scope.
Authentication failures
Missing, malformed, unknown, revoked, expired, or insufficient-scope credentials receive `401`. Storage/protection dependency failures return `503` rather than being presented as a bad credential. Do not retry authorization errors without correcting the credential or permissions.