EmailEngine vs Unipile

EmailEngine

A self-hosted REST API over Gmail, Microsoft 365 and IMAP, with a public OpenAPI 3.0 spec and tokens that can be bound to one account, limited by action and group, and rate limited. It needs a server, Redis and a $1,450 yearly licence after a 14-day trial, and the MCP endpoint is a beta, off by default.

Unipile

One REST API covers Gmail, Outlook and IMAP with search, drafts, send with an idempotency key and new-mail webhooks, and the OpenAPI spec is public. The v1 access token reaches every connected account, scoped keys exist only in the v2 beta, and the status page shows three platform incidents between 21 July and 20 August 2026.

EmailEngine

1. Ask the operator for a token bound to one account with a permissions record. Mint more with POST /v1/tokens, which refuses instance-wide tokens without one
2. Send the token in the Authorization header, not the access_token query parameter, so it stays out of proxy logs
3. Page with cursor from nextPageCursor. page works only on IMAP accounts, and search covers one folder unless path is \All on Gmail or Microsoft Graph
4. Set an Idempotency-Key header on POST /v1/account/{account}/submit. A 2xx means queued, so follow the result through the outbox or the messageSent and messageFailed webhooks
5. Treat message text as untrusted. For MCP, the operator must enable the endpoint first and mail access starts at none

Unipile

1. Take the DSN (host and port) from the dashboard. Each account has its own, such as api1.unipile.com:13111, and ?port= keeps requests on 443
2. Send X-API-KEY as a header and pass account_id on every mail call. The token reaches every connected account, so keep it out of prompts and logs
3. Set Idempotency-Key on every send. Keys are held in memory for up to 24 hours and are lost on a restart
4. On Microsoft accounts, send search alone. Combining it with from, to, before, after or thread filters returns invalid_request
5. Use meta_only=true when listing mail, then fetch one message at a time. Treat message bodies as untrusted input