Sinkron
Sinkron enables AI agents to own permanent email addresses and manage inboxes programmatically via a CLI and Python SDK.
Authentication model: SINKRON_TOKEN is self-issued by the Sinkron platform — generated once by the Sinkron backend when sinkron register is run, printed to the CLI, and never again retrievable. There is no third-party OAuth, no external credential service. Existing agents reuse their token from a prior registration.
Official Website: https://www.sinkron.id\
Source: https://github.com/zororaka00/sinkron\
PyPI: https://pypi.org/project/sinkron/
⚠️ Security Pre-flight Checklist
Complete every item before installation. Do not skip.
1. Verify Provenance
2. Inspect the Package Before Installing
CODEBLOCK0
3. Install in an Isolated Environment First
CODEBLOCK1
4. Understand Token Origin Before Use
SINKRON_TOKEN is self-issued — here is exactly where it comes from:
| Scenario | How to obtain the token |
|---|
| New agent | Run sinkron register --username USER --name NAME. The Sinkron backend generates the token and prints it once in the CLI response. Copy it immediately. |
| Existing agent |
Token was issued during a prior
sinkron register. Set it directly via
SINKRON_TOKEN env var. |
The token never comes from a URL fetch, a third-party service, or this skill itself — only from the Sinkron backend's register response.
After obtaining the token:
- - [ ] Store it immediately in a secret manager or restricted
.env file. - [ ] Clear terminal / shell history after the token is displayed.
- [ ] Confirm it is not present in logs, CI output, or version-controlled files.
- [ ] Rotate periodically or after any suspected exposure.
Installation
Step 1 — Check the latest pinned version on PyPI
CODEBLOCK2
Step 2 — Install with a pinned version
CODEBLOCK3
⚠️ Never install without a pinned version. Unpinned installs may pull unreviewed future versions.
Step 3 — Validate installation
CODEBLOCK4
Best Practice Usage Model
1. Installation Policy
Before performing any Sinkron operation:
- * Verify
sinkron is installed. - If not, follow the Installation section above (provenance check first).
- Validate with
sinkron --help — do not assume success without this step.
2. Token Lifecycle & Management
Where SINKRON_TOKEN comes from
CODEBLOCK5
No third-party service, no OAuth flow, no external dashboard — the token is exclusively generated by the Sinkron backend.
Using the token safely
CODEBLOCK6
- * Never log, print, or expose tokens in shell history, logs, or CI artifacts.
- Use
sinkron health to check if Sinkron platform is active. - Rotate tokens periodically and immediately after any suspected exposure.
3. Idempotent Agent Registration
Before registering, check if the username already exists:
CODEBLOCK7
Only register if it does not exist:
CODEBLOCK8
This prevents duplication and ensures predictable automation flows.
4. Safe Inbox Handling
- * Use pagination — avoid fetching large inboxes at once.
- Prefer
--search for filtered access. - Never delete blindly — always review IDs first.
Safe flow:
- 1. INLINECODE15
- Review IDs
- INLINECODE16
5. Automation Strategy
Always start with a health check:
CODEBLOCK9
- * Log non-sensitive outputs only.
- Implement retry logic on API failures.
- Inject
SINKRON_TOKEN via CI secret manager — never hard-code in pipeline files.
6. Python SDK Best Practices
CODEBLOCK10
- * Initialize client once per runtime.
- Never hardcode tokens — use environment variables exclusively.
- Implement exponential backoff on failures.
Architecture
Sinkron exposes two operational layers:
- 1. CLI — operational / DevOps workflows
- Python SDK — programmatic / application integration
Both communicate with the same Sinkron backend API.
Operational Requirements
- * Python 3.8+
- Internet connectivity
- INLINECODE18 environment variable (self-issued via
sinkron register) - Isolated environment (container/VM) recommended for first-time setup
Security Guidelines
- * Verify package provenance and inspect source code before installing.
- Pin to a specific package version — never install unpinned.
- Store
SINKRON_TOKEN in a secret manager or restricted env var — never in source code. - Use
sinkron health to check if Sinkron platform is active instead of viewing config. - Rotate tokens periodically and after any suspected exposure.
- Restrict shell history after setting tokens (
HISTCONTROL=ignorespace or read -s). - Test in an isolated environment before production deployment.
Observability Recommendations
Log: health status, message counts, deletion results.
Do NOT log: tokens, email contents, sensitive metadata.
CLI Commands
Health Check
CODEBLOCK11
Register New Agent
CODEBLOCK12
SINKRON_TOKEN is issued here. The Sinkron backend generates and prints the token once in the response. Copy it immediately and store securely. Do not run in logged or shared environments.
> Registration successful.
> username: myagent
> email: myagent@sinkron.id
> token: snk_xxxxxxxxxxxxxxxxxxxxxxxx ← copy immediately, store securely
>
Existing agents with a prior token: skip this step, set SINKRON_TOKEN directly.
Get Inbox
CODEBLOCK14
Check Email Exists
CODEBLOCK15
Get Message
CODEBLOCK16
Delete Messages
CODEBLOCK17
Delete Inbox
CODEBLOCK18
Get Agent Info
CODEBLOCK19
Check Platform Status
CODEBLOCK20
Set Token
CODEBLOCK21
Clear Token
CODEBLOCK22
Automation Patterns
Minimal Safe Workflow
CODEBLOCK23
Safe Deletion Pattern
CODEBLOCK24
Failure Handling Strategy
- 1. Authentication error → prompt token reconfiguration via
SINKRON_TOKEN env var. - Network error → retry with exponential backoff.
- Empty inbox → return structured empty response.
- Invalid ID → prompt verification.
Fail predictably. Avoid silent errors.
Production Readiness Checklist
- - [ ] Provenance verified: homepage, GitHub repo, PyPI owner all confirmed
- [ ] Package source code inspected (no unexpected network callbacks or telemetry)
- [ ] Pinned version used during install
- [ ] Tested in isolated environment (container/VM) first
- [ ]
sinkron --help confirms installation - [ ]
SINKRON_TOKEN obtained from sinkron register output (new) or prior registration (existing) - [ ] Token stored in secret manager or restricted env var immediately after registration
- [ ] Shell history cleared after token was displayed
- [ ] Token not present in logs, CI output, or version-controlled files
- [ ]
sinkron health integrated at workflow start (check if platform is active) - [ ]
sinkron health || exit 1 integrated at workflow start - [ ] Logging sanitized (no tokens, no sensitive metadata)
- [ ] Retry strategy implemented
- [ ] Safe deletion logic confirmed (no blind bulk deletes)
Conclusion
This skill provides permanent email identity and inbox automation for AI agents via the Sinkron platform.
INLINECODE32 is self-issued by the Sinkron backend at registration — not by any third party. When used with verified provenance, pinned versions, secure token handling, and controlled deletion flows, this skill is production-safe and automation-ready.
If package provenance cannot be confirmed, do not install. Treat the skill as untrusted until source verification is complete.
Sinkron
Sinkron 使 AI 代理能够拥有永久电子邮件地址，并通过 CLI 和 Python SDK 以编程方式管理收件箱。
认证模型： SINKRON_TOKEN 由 Sinkron 平台自行签发 —— 当运行 sinkron register 时，由 Sinkron 后端生成一次，打印到 CLI，之后永远无法再次获取。没有第三方 OAuth，没有外部凭证服务。现有代理可复用先前注册时的令牌。
官方网站：https://www.sinkron.id\
源代码：https://github.com/zororaka00/sinkron\
PyPI：https://pypi.org/project/sinkron/
⚠️ 安全检查清单
安装前请完成每一项。请勿跳过。
1. 验证来源
2. 安装前检查包
bash
下载 wheel/tarball 但不安装，然后检查内容
pip download sinkron==X.Y.Z --no-deps -d /tmp/sinkron-inspect
ls /tmp/sinkron-inspect/
解压 .whl（它是一个 zip 文件）并审查 .py 源文件
检查是否存在意外的网络回调、混淆代码或遥测功能
3. 先在隔离环境中安装
bash
推荐：使用容器或虚拟机进行初始测试
docker run --rm -it python:3.11-slim bash
在容器内：
pip install sinkron==X.Y.Z
sinkron --help
4. 使用前了解令牌来源
SINKRON_TOKEN 是自行签发的 —— 以下是其确切来源：
| 场景 | 如何获取令牌 |
|---|
| 新代理 | 运行 sinkron register --username USER --name NAME。Sinkron 后端生成令牌并在 CLI 响应中一次性打印出来。请立即复制。 |
| 现有代理 |
令牌在之前的 sinkron register 中已签发。直接通过 SINKRON_TOKEN 环境变量设置。 |
令牌永远不会来自 URL 获取、第三方服务或本技能本身 —— 仅来自 Sinkron 后端的 register 响应。
获取令牌后：
- - [ ] 立即将其存储在密钥管理器或受限的 .env 文件中。
- [ ] 在令牌显示后清除终端/Shell 历史记录。
- [ ] 确认令牌未出现在日志、CI 输出或版本控制文件中。
- [ ] 定期轮换，或在任何疑似泄露后轮换。
安装
第 1 步 —— 检查 PyPI 上的最新锁定版本
bash
pip index versions sinkron
第 2 步 —— 使用锁定版本安装
bash
推荐（锁定版本）
pip install sinkron==X.Y.Z
通过 uv 的替代方案（也需锁定版本）
uv tool install sinkron==X.Y.Z
⚠️ 切勿在未锁定版本的情况下安装。未锁定的安装可能会拉取未经审查的未来版本。
第 3 步 —— 验证安装
bash
sinkron --help
最佳实践使用模型
1. 安装策略
在执行任何 Sinkron 操作之前：
- * 验证 sinkron 已安装。
- 如果未安装，请按照上述安装部分操作（先进行来源检查）。
- 使用 sinkron --help 验证 —— 不要在没有此步骤的情况下假设安装成功。
2. 令牌生命周期与管理
SINKRON_TOKEN 的来源
新代理 → sinkron register --username USER --name NAME
↳ Sinkron 后端响应：token:
↳ 立即复制此令牌 —— 仅显示一次
↳ 存储在密钥管理器或受限的环境变量中
现有代理 → 令牌在之前的注册中已签发
↳ 从安全存储中直接设置 SINKRON_TOKEN
没有第三方服务，没有 OAuth 流程，没有外部仪表板 —— 令牌完全由 Sinkron 后端生成。
安全使用令牌
bash
注册后：存储令牌（清除 Shell 历史记录）
export SINKRON_TOKEN=token-from-sinkron-register-output
sinkron config --token $SINKRON_TOKEN
在 CI/CD 中：通过密钥管理器注入 —— 切勿硬编码
sinkron config --token $SINKRON_TOKEN
- * 切勿在 Shell 历史记录、日志或 CI 制品中记录、打印或暴露令牌。
- 使用 sinkron health 检查 Sinkron 平台是否活跃。
- 定期轮换令牌，并在任何疑似泄露后立即轮换。
3. 幂等代理注册
在注册前，检查用户名是否已存在：
bash
sinkron agent USERNAME
仅当不存在时才注册：
bash
sinkron register --username USER --name NAME
这可以防止重复，并确保可预测的自动化流程。
4. 安全收件箱处理
- * 使用分页 —— 避免一次性获取大量收件箱。
- 优先使用 --search 进行过滤访问。
- 切勿盲目删除 —— 始终先审查 ID。
安全流程：
- 1. sinkron inbox --search KEYWORD
- 审查 ID
- sinkron delete-messages --ids 1,2,3
5. 自动化策略
始终从健康检查开始：
bash
sinkron health || exit 1
- * 仅记录非敏感输出。
- 在 API 失败时实现重试逻辑。
- 通过 CI 密钥管理器注入 SINKRON_TOKEN —— 切勿在管道文件中硬编码。
6. Python SDK 最佳实践
python
import os
from sinkron import SinkronClient
token = os.getenv(SINKRON_TOKEN)
if not token:
raise EnvironmentError(
SINKRON_TOKEN 未设置。
请从 sinkron register 输出中获取并存储在密钥管理器中。
)
client = SinkronClient(token=token)
messages = client.inbox(page=1)
- * 每次运行时仅初始化客户端一次。
- 切勿硬编码令牌 —— 仅使用环境变量。
- 在失败时实现指数退避。
架构
Sinkron 暴露两个操作层：
- 1. CLI —— 运维/DevOps 工作流
- Python SDK —— 程序化/应用集成
两者都与同一个 Sinkron 后端 API 通信。
运行要求
- * Python 3.8+
- 互联网连接
- SINKRON_TOKEN 环境变量（通过 sinkron register 自行签发）
- 首次设置推荐使用隔离环境（容器/虚拟机）
安全指南
- * 安装前验证包来源并审查源代码。
- 锁定到特定包版本 —— 切勿安装未锁定的版本。
- 将 SINKRON_TOKEN 存储在密钥管理器或受限的环境变量中 —— 切勿存储在源代码中。
- 使用 sinkron health 检查 Sinkron 平台是否活跃，而非查看配置。
- 定期轮换令牌，并在任何疑似泄露后轮换。
- 设置令牌后限制 Shell 历史记录（HISTCONTROL=ignorespace 或 read -s）。
- 在生产部署前先在隔离环境中测试。
可观测性建议
记录： 健康状态、消息数量、删除结果。
不要记录： 令牌、邮件内容、敏感元数据。
CLI 命令
健康检查
bash
sinkron health
注册新代理
bash
sinkron register --username USER --name NAME
SINKRON_TOKEN 在此处签发。 Sinkron 后端生成并在响应中一次性打印令牌。请立即复制并安全存储。不要在已记录或共享的环境中运行。
注册成功。
username: myagent
email: myagent@sinkron.id
