Platform
Reaching a provider is a weekend. Staying connected is a year.
The prototype always works. What takes the year is sync that survives a reconnect, pacing inside quotas you have not discovered yet, cursor recovery, reconnects your users complete themselves and delivery you can replay. Aux0 is those five things with an API in front of them.
One account, one week
- Messages sent1660/2000 today
- Recipients4800/10000 today
- API units212/800 per second
- Backfill pages37/100 in flight
What we run so you do not
7 piecesNone of it is visible on day one. All of it is yours forever if you build it.
Each of these is a thing a team discovers in month two, after the demo has already been given. They are listed with the one fact that makes each checkable rather than as adjectives.
Connections
A connection that outlives the token that opened it
A connected account refreshes its own credentials for as long as the provider allows, reconnecting through transient failures and backing off at the first sign of pushback. An IMAP socket that drops is re-established and the cursor picks up where it stopped.
Token refresh and reconnection are automatic. There is nothing to configure.
Pacing
A send that would cross a limit is queued, not rejected
Letting the provider reject a send costs you a retry and the account some standing. Aux0 tracks what each account has spent against each of its quota windows and holds the send until there is room — and exposes what is left, so your own scheduler can plan instead of discovering.
GET /v1/accounts/:id returns every window and its remaining budget.
Activity window
Work that runs when the account is awake
Each account carries a weekly window in its own timezone, so it follows wall clock through a daylight-saving change. Work scheduled outside it is queued until the window opens rather than sent at three in the morning from a person who is asleep.
Per account, per weekday, with the timezone stored alongside.
Sync
One cursor per account, held across reconnects
IMAP can invalidate a whole cursor without warning, and a naive sync answers by re-downloading the mailbox. Aux0 holds the sync position per account, detects the invalidation and reconciles rather than starting again.
Backfill progress and cursor state are on the account object.
Recovery
A reconnect is the user's problem, not your support queue's
Credentials expire: a revoked grant, a changed password, an app password rotated away. Aux0 detects it, queues rather than fails, and tells you which end user to ask — and the link you send them is the one you already built.
One event, one link, no second flow to build.
Delivery
Your endpoint going down costs you nothing
Every event is signed with HMAC-SHA256 and retried five times over about thirty minutes. A delivery that never lands is held for seven days and replayed from the dashboard or the API once you are back.
Order is not guaranteed; ids are idempotent and created_at is authoritative.
Evidence
An audit log that names the key, not the service
Every action is attributed to the API key that made it, with the request id the error carried. Scope a key to read-only for a pilot, set message retention to zero if your review asks for it, and the log still answers who did what.
Request ids are retained 30 days; content retention is yours to set.
Pacing and windows
FiguresRate ceilings
Every window, and what is left in it
Letting the provider reject a send costs the account some trust each time. Aux0 tracks the spend per window and holds a send until there is room, and the remaining budget is on the account object so your own scheduler can plan.
- Messages sent1660/2000 today
- Recipients4800/10000 today
- API units212/800 per second
- Backfill pages37/100 in flight
Activity window
The account keeps the user's hours
A weekly window per account, stored with its timezone so it follows wall clock through a daylight-saving change. Work scheduled outside it is queued until the window opens, and nothing from the account touches the provider meanwhile.
A product that sends until the provider says no has built a tool for losing its customers' accounts.
Why pacing is a feature, not a limitation
Sync and health
FiguresSync cursors
One cursor per account, held across reconnects
IMAP can invalidate a whole cursor without warning, and a naive sync answers by re-downloading the mailbox. Aux0 holds the position per account, detects the invalidation and reconciles rather than starting the backfill again.
- tom@northwind.io · Gmail
historyId 9f21a4live - maya@northwind.io · Outlook
delta #8c17live - lena@northwind.io · IMAP
uid 104192backfilling
Account health
Written for the end user, not for your engineer
When an account needs attention the dashboard says what the provider asked for in words the account's owner understands, and offers the button that sends them the link. Your support team can open this screen.
Recovery and delivery
FiguresReconnect recovery
One webhook, and a link your users already have
The anti-pattern is treating a reauthorisation as an error: logging it, alerting your team, waiting for a human. These are routine, they belong to the end user, and a user fixes one in under a minute.
- The refusal is detectedAux0
Not as a 4xx you have to decode. Sends for that account are queued rather than failed, and the sync cursor is held where it is.
- You get one eventWebhook
account.needs_user names the account, what the provider asked for, and the end user id you gave us.
- The user fixes itEnd user
The same hosted auth link that connected the account reconnects it. Written for them, not for your engineer. Under a minute.
- The queue drainsAux0
account.connected clears the notice and everything held while it was broken goes out, paced.
Webhooks
A dead endpoint costs you nothing
Signed with HMAC-SHA256, retried five times over about half an hour, failed deliveries held seven days and replayable from the dashboard or the API. Order is not guaranteed, so treat the id as idempotent.
- 13:58:04try 1502 Bad GatewayFailed
- 13:58:34try 2502 Bad GatewayFailed
- 14:00:04try 3timeout after 10sFailed
- 14:06:04try 4502 Bad GatewayFailed
- 14:21:04try 5502 Bad GatewayFailed
- 15:40:11replay200 OKDelivered
Evidence
The things your security review will ask for
Not a certification we do not hold — the mechanics underneath one.
- You never hold a credential: passwords, QR scans and one-time codes are entered on a page we serve, and you get an account id
- Keys scope to read-only, so a pilot cannot send
- Message retention is yours to set, including to zero
- Every action is attributed to the key that made it
- Request ids on every response, retained 30 days
- Deleting an account destroys its credentials immediately and its content within 30 days
What we cannot promise
HonestlyEverything above removes a cause. None of it removes the risk.
Automating a personal account is against most providers' terms. A provider can restrict an account for reasons that have nothing to do with you, and no vendor — us included — can promise otherwise. We say that here rather than in a footnote, and the approach page says why the trade is still worth making.
- We are not SOC 2 certified. It is a third-party attestation with an observation period, and we will say we have one when an auditor has issued the report
- We cannot make a provider publish an endpoint it has not published
- An account whose owner changes their password stops working until they reconnect it
- Pacing makes sending slower. That is the point, and it is not negotiable
Questions
FAQWhat actually breaks a connected account?
In order of frequency: the provider asking for a security check, the user logging out or changing their password, a session expiring on its own schedule, and traffic that looks automated — unvaried polling, activity at three in the morning, or an IP that moves country. The first two belong to the user and Aux0 routes them to the user. The last two are ours to prevent.
Can you guarantee an account is never rate-limited?
No, and nobody can. A provider can throttle or suspend an account for reasons that have nothing to do with you. What we can do is everything on this page, which removes the causes that are under anyone's control — above all retrying into a limit instead of holding.
What happens if a sync cursor is invalidated?
IMAP can invalidate a cursor without warning, and a naive client answers by re-downloading the whole mailbox. Aux0 detects the invalidation, reconciles against what it already holds, and keeps the account live rather than starting the backfill again.
What happens to sends while an account is broken?
They queue. Nothing is silently dropped and nothing is retried against a provider that has stopped accepting the credentials. When the user reconnects, the queue drains at the account's normal pace.
How do I know what my own limits are right now?
Read the account. Every window it has and the budget remaining in each come back on the account object, so your scheduler can plan against them rather than discover a cap by crossing it.
Connect one account and watch it stay connected
Free, forever, with the pacing and the recovery on it from the first day.