Verify your installation

Check your installation#

Use only mailboxes, domains, and webhook receivers you control for these checks.

• Open the app without a session and confirm Access sign-in. Confirm Access also protects /oauth/authorize.
• Sign in as the owner and confirm that a member without a grant cannot read the owner's addresses.
• Send a transactional message to an external mailbox you control. Check receipt and a delivered event in the message log.
• Reply from that mailbox and confirm the reply arrives in the correct thread.
• Send to a plus-tagged address and confirm the intended address receives it.
• Create a domain API key and verify that it cannot operate on a different domain.
• If using webhooks, verify a signed event at your controlled HTTPS receiver.
• Confirm that disabled AI does not make model calls. Request a summary only after enabling AI deliberately.

A preview request visits the selected link only after confirmation. That visit can trigger one-click unsubscribe, confirmation, or magic-login actions. PDF export renders stored mail with network access blocked. Keep preview checks separate from a mail-delivery check.

Run and review these checks before relying on the installation.

Release installation verification#

Box Ox is distributed directly from boxox.dev as a source ZIP, standalone CLI, SDK package, and agent skill. Use the CLI deployment procedure above or give your agent https://boxox.dev/install-agent.md. There is no npm registry publication and no one-click deployment claim.

The source-download installation was exercised with isolated Worker, D1, R2, KV, Vectorize, Queue, and Workflow resources in an existing Workers Paid account. That test covered provisioning, migrations, workers.dev hosting, source-version health, and rejection of anonymous protected/API requests. It does not establish behavior on a brand-new Cloudflare account or complete your domain/Access setup for you. Use the mail checks above on each installation before relying on it. The unchanged 2.4.0 source also installed in a fresh Workers Free account without domains. Owner sign-in and empty app pages passed after user-completed billing checkouts and separate Access configuration. The agent removal procedure later removed that empty installation and its dedicated resources. Mail delivery, populated-mail recovery, and Free throughput remain unverified. There is no separate fresh-account deployment result for the current patch release.

For an additional installation in the same account, give all resources unique names in wrangler.jsonc: Worker, D1, R2, Vectorize, queues and dead-letter queues, workflows, analytics dataset, and rate-limit namespace IDs. KV is named from the Worker name. Commit those changes before deployment. The helper carries the configured Worker, email-events queue, webhook queue, and mail bucket names into runtime onboarding.