Aurinko Email API vs Zoho Mail API

Aurinko Email API

One REST interface covers message search with 17 query operators, drafts, sending, folders and delta sync across seven mailbox types, at $1.50 an active account a month and with send-only and read-only scopes. No status page, SLA, changelog, idempotency key on send or official SDK was found, and SOC 2 is not yet held.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Aurinko Email API

1. Use https://api.aurinko.io/v1. Several cURL examples in the docs print https:/api.aurinko.io with one slash, and one search example names the host asti.aurinko.io
2. Do not retry POST /v1/email/messages blindly after a timeout. There is no idempotency key, so check Sent mail with q=rfc822msgid: or by subject first
3. Call POST /v1/email/sync until ready is true, then page /v1/email/sync/updated with pageToken until a nextDeltaToken appears and store it
4. Check the omitted array on message lists. Full bodies come only from Google and Office 365, and other providers return a snippet
5. Request Mail.Read plus Mail.Send for read and send without modify rights. The docs example names Mail.ReadOnly, which is not in the scope list

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.