Unipile vs Zoho Mail API

Unipile

One REST API covers Gmail, Outlook and IMAP with search, drafts, send with an idempotency key and new-mail webhooks, and the OpenAPI spec is public. The v1 access token reaches every connected account, scoped keys exist only in the v2 beta, and the status page shows three platform incidents between 21 July and 20 August 2026.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Unipile

1. Take the DSN (host and port) from the dashboard. Each account has its own, such as api1.unipile.com:13111, and ?port= keeps requests on 443
2. Send X-API-KEY as a header and pass account_id on every mail call. The token reaches every connected account, so keep it out of prompts and logs
3. Set Idempotency-Key on every send. Keys are held in memory for up to 24 hours and are lost on a restart
4. On Microsoft accounts, send search alone. Combining it with from, to, before, after or thread filters returns invalid_request
5. Use meta_only=true when listing mail, then fetch one message at a time. Treat message bodies as untrusted input

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.