# Email webhook trigger

> Run a workflow when an email arrives at a Cotera address: the normalized message payload, authentication, and deduplication.

Source: https://cotera.co/docs/reference/webhooks/email

---

Run a workflow when mail arrives at an address Cotera mints for the trigger, like `deals-k3f9x2@inbound.cotera.ai`. The normalized message becomes the workflow's input. It's the trigger to reach for when the person starting the work is outside your systems — a customer, a vendor, a candidate — or when the source can only email you.

For setup, see [Email your agent](https://cotera.co/docs/deploy/email-your-agent.md). This page documents the delivery behavior and payload.

## Event

| Event key        | Fires when                                      |
| ---------------- | ----------------------------------------------- |
| `email.received` | An email is delivered to this trigger's address |

There's one event and it needs no configuration; every message to the address runs the workflow.

## Authentication

Inbound email carries no provider signature, so there is nothing to verify per message. **The address is the credential**: Cotera appends a random suffix (the `-k3f9x2` above) so the address can't be guessed, and the incoming mail stream is authenticated once at the edge before it's dispatched. Treat the address like a webhook URL — don't publish it anywhere you wouldn't publish a secret.

## Payload

Cotera normalizes the message and hands the workflow this shape:

```json
{
  "matchedAddress": "deals-k3f9x2@inbound.cotera.ai",
  "from": "Alice Smith <alice@example.com>",
  "to": "deals-k3f9x2@inbound.cotera.ai",
  "cc": "",
  "subject": "Invoice question",
  "text": "Hi — can you tell me what invoice 4471 covers?\n\nThanks,\nAlice",
  "html": "<p>Hi — can you tell me what invoice 4471 covers?</p>",
  "messageId": "<CAF7a2ab@mail.example.com>",
  "spf": "pass",
  "dkim": "{@example.com : pass}",
  "spamScore": "0.1",
  "attachments": []
}
```

| Field                | Description                                                                     |
| -------------------- | ------------------------------------------------------------------------------- |
| `matchedAddress`     | The Cotera address the mail matched — the trigger's inbox.                      |
| `from` / `to` / `cc` | The message envelope, as received.                                              |
| `subject`            | The subject line.                                                               |
| `text` / `html`      | The plain-text and HTML bodies. Either may be empty depending on the sender.    |
| `messageId`          | The originating mail server's Message-ID.                                       |
| `spf` / `dkim`       | Sender-authentication results — use them to decide how far to trust the sender. |
| `spamScore`          | The inbound spam score, as a string.                                            |
| `attachments`        | Attachment metadata (names), as an array.                                       |

## Deduplication

Each email trigger is identified by its address, so every trigger stands up its own independent inbox — creating a second email trigger never collapses onto the first.