iCloud Mail

iCloud Mail does not accept your main Apple Account password from third-party apps. You need an app-specific password, and your Apple Account must use two-factor authentication.

App-specific password

You can revoke it at any time on the same page.

See Apple’s guide: https://support.apple.com/en-us/102654. The server’s sign-in page walks users through the same steps.

Managing your connection

/account on your server (linked from every page’s footer) lets you sign in with your iCloud Mail address and an app-specific password to see your connection, disconnect every AI app at once, or delete everything the server stores about you. Signing in there with a new app-specific password replaces the stored one and signs out other browsers on the account page, which is how you rotate it. Signing in again with the same password leaves those sessions in place.

The same page can turn on a new-mail webhook: when mail arrives in your Inbox, the server POSTs a small signed JSON event to an HTTPS URL of your choice (sender and subject only if you opt in). See New-mail webhooks.

Does iCloud save SMTP-sent mail to Sent?

No. On a live iCloud account, a message sent through smtp.mail.me.com was still missing from “Sent Messages” about 25 seconds later, which matches earlier public reports.

So send_message and reply_to_message save the copy themselves by default (save_to_sent, default true): after sending, the server looks for a message with the same Message-ID in the Sent folder and appends a copy only if none is there, so a server that does store its own copy never gets a duplicate.

Folder roles

iCloud’s folders are INBOX, Sent Messages, Deleted Messages, Archive, Junk and Drafts. Only Sent Messages and Deleted Messages are advertised with special-use flags (RFC 6154). When the server doesn’t advertise a role, list_folders infers it from the conventional name (Archive, Junk or Spam, Drafts, Sent, Trash or Deleted Messages), so models can find these folders by role on any server.