Uploaded. Now connect your private workspace.
This is the setup screen, not an error. No mailbox is connected and no password is collected here. Finish the settings below in Cloudflare, then re-upload the same ZIP to apply them.
You do not need Node.js or terminal commands for this package. The backend is already compiled.
1. Create the database
In Cloudflare, open Storage & databases → D1 → Create database. Name it casepost-private. Open its Console and run this SQL:
CREATE TABLE IF NOT EXISTS accounts (id TEXT PRIMARY KEY, provider TEXT NOT NULL, address TEXT NOT NULL, encrypted_token TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP, UNIQUE(provider,address)); CREATE TABLE IF NOT EXISTS oauth_states (id TEXT PRIMARY KEY, owner TEXT NOT NULL, provider TEXT NOT NULL, verifier TEXT NOT NULL, expires INTEGER NOT NULL); CREATE TABLE IF NOT EXISTS send_attempts (id TEXT PRIMARY KEY, status TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP);
In your Pages project → Settings → Bindings (or Functions bindings), add a D1 database binding named DB and select this database. Apply to Production. Dashboard labels can vary.
2. Restrict sign-in to yourself
Choose one production hostname. Configure a Cloudflare Access self-hosted application covering that full hostname, all paths. Set an Allow policy for only your own email. Use an identity provider or email OTP; do not create an Everyone or Bypass rule. Copy the application AUD and the team address.
If your account's Access setup cannot protect the production pages.dev hostname, add a domain you control to the Pages project and protect that custom hostname. A preview-only Access setting does not protect production. Do not remove owner checks to work around this.
3. Add environment variables
In Pages → your project → Settings → Variables and Secrets, configure these for Production:
| Name | Value |
|---|---|
| APP_ORIGIN | Your exact production URL, such as https://your-project.pages.dev, without a trailing slash |
| OWNER_EMAIL | The one email allowed to sign in to this dashboard |
| ACCESS_ISSUER | https://your-team.cloudflareaccess.com |
| ACCESS_AUD | The Access application's audience tag |
| TOKEN_KEY | A secret containing the generated key below |
Use this generator once for a new installation. The key is generated in your browser and is not sent anywhere by this page. Save it in your password manager. Replacing an existing key makes existing saved credentials unreadable.
4. Enable the accounts you want
Gmail: Enable Gmail API and create a Web OAuth client in Google Cloud. Set its redirect URI to YOUR_ORIGIN/oauth/google/callback. Add GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET as Cloudflare secrets. Add your Gmail accounts as test users if using testing mode. The app requests read and send permissions. Google's verification and testing restrictions apply.
Outlook: Register a Web app in Microsoft Entra, supporting the account types you use. Set its redirect URI to YOUR_ORIGIN/oauth/microsoft/callback. Add MICROSOFT_CLIENT_ID and MICROSOFT_CLIENT_SECRET as secrets. Delegated permissions: Mail.Read, Mail.Send, User.Read and offline_access. Work tenants may require admin consent.
Company IMAP: Add IMAP_HOSTS with the verified incoming server hostname. For replies add SMTP_HOSTS with the verified outgoing hostname. Multiple hosts can be comma-separated. This connector supports IMAP TLS port 993 and SMTP TLS port 465, AUTH LOGIN, same account credentials. STARTTLS port 587 and OAuth-only IMAP are not supported by this connector. Do not guess the host from the webmail URL. Enter the mailbox password only inside the protected dashboard after setup.
5. Enable sentence correction and summaries
In project bindings, add a Workers AI binding named AI if available for your account. Text is sent to Cloudflare Workers AI only when you use Make professional or Summarise with AI. Review the service terms, charges and workplace data policy before enabling it. Without this binding, mail reading and replies can work, but the AI buttons report that setup is required.
6. Re-upload and check
Set the Functions compatibility date to 2026-09-01 or later. Re-upload the same ZIP as a new Production deployment after changing bindings or variables. Open your production URL in a private browser window: your owner sign-in must be required and other users must be denied. If the configuration is complete but sign-in fails, check the Access hostname, issuer and AUD; do not disable authentication.
Once inside, choose Connect mailbox. Add each account, select a mailbox or All connected mailboxes, and refresh. Test using personal test emails first.
Limits: Latest 20 INBOX emails per account; long messages may be truncated; attachments and other folders are excluded. AI may make mistakes. Sending requires your review and confirmation. SMTP acceptance is not proof of delivery, and SMTP replies are not copied into Sent by this app. No live account integration or security audit has been performed. No system is 100% secure.