Fastmail API (JMAP) vs Zoho Mail API

Fastmail API (JMAP)

A mailbox API built on the open JMAP standard, with read-only tokens, six OAuth scopes and an MCP server that separates read, write and send access. Fastmail publishes no OpenAPI file, SDK, API changelog, request rate limit or SLA, and its customer terms forbid programmatically generated email to addresses outside the account.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Fastmail API (JMAP)

1. Fetch https://api.fastmail.com/jmap/session with Authorization: Bearer <token> first. It returns the API URL, account IDs and the request limits to stay under
2. Ask the owner for a read-only token unless the task writes. Sending needs both the Email and Email submission scopes
3. Request only the properties you need. Body text is not returned unless fetchTextBodyValues is set, and maxBodyValueBytes caps it
4. Sync with Email/changes from a stored state. On cannotCalculateChanges, fetch again from scratch
5. Do not send generated mail to outside recipients without the owner's review. The customer terms forbid it, and trial accounts stop at 120 messages a day

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.