Docs - Getting Started

Documentation

Everything you need to know about CoBox - the privacy-first AI account management and disposable email platform.

Introduction

CoBox is a privacy-first platform built for teams and individuals who need secure, temporary digital identities for AI services. It combines a disposable email engine, an OTP extractor, a shared account vault, and a context builder - all in one clean interface.

CoBox is ideal for onboarding to AI platforms like Claude and ChatGPT, managing multiple accounts securely, extracting verification codes automatically, and protecting your real identity from spam and tracking.

CoBox operates entirely server-side. Email contents are fetched on-demand and never persisted to our database. All processing is ephemeral by design.

Generate a Disposable Email

1

Open the Credentials panel

From your CoBox dashboard, click the "Generate Credentials" section to open the disposable email generator.

2

Click "Generate Email Address"

A cryptographically random address at aiplex.app is instantly created. The address uses 8 random alphanumeric characters generated using crypto.getRandomValues() - not Math.random().

3

Copy & use it anywhere

Paste the address into any sign-up form. CoBox polls your inbox automatically and emails appear in real time - no manual refresh needed.

Generated addresses are tied to your account. Only you can access the inbox for addresses you created.

Account Vault

The Account Vault stores the credentials (email + password) of accounts you've created on third-party platforms. All stored passwords are encrypted at rest using AES-256-GCM before being written to the database.

Adding an account

  • Select a platform (e.g. Claude, ChatGPT, Perplexity)
  • Enter the disposable email and generated password
  • Click Save - CoBox encrypts the password before storage

Shared Vault

Accounts marked as "Shared" become visible to all team members. Use the Shared Vault for accounts that the entire team needs access to, such as demo accounts or testing credentials.

OTP Retrieval

CoBox automatically scans incoming emails for numeric verification codes (OTPs). When detected, the code is displayed prominently in the inbox panel and can be copied instantly with one click.

How it works

  • CoBox polls the inbox every few seconds when the wizard is active
  • Emails are parsed server-side using contextual pattern matching
  • 4-8 digit codes near keywords like "verification", "OTP", "code", or "pin" are extracted
  • The most recent, relevant code is surfaced automatically

OTP polling is limited to emails delivered in the last 60 minutes to prevent history mining.

Magic Link Resolution

Some services (like Perplexity and Claude) send a "magic link" instead of a numeric code - a URL you click to verify your account. CoBox detects these links and surfaces them for you to open directly.

Magic link detection is supported for Anthropic (Claude) and Perplexity. The link is extracted from the email and displayed as a clickable button in the inbox panel.

Supported Platforms

CoBox ships with a curated list of AI platforms and productivity tools, including:

  • AI Services - Claude, ChatGPT, Perplexity, DeepSeek, Gemini, Grok, and more
  • Dev Tools - GitHub, Vercel, Netlify, Supabase, and others
  • Productivity - Notion, Slack, and other SaaS platforms

Each platform entry includes the sign-up URL, OTP/magic link instructions, and account-specific notes to guide you through the creation flow.

Shared Vault

The Shared Vault is a team-wide repository of accounts that all members of your CoBox workspace can view and use. It is ideal for shared demo credentials, team testing accounts, or rotating access tokens.

Only accounts explicitly marked as "Shared" by their owner appear in the Shared Vault. Your private accounts remain visible only to you.

Context Builder

The Context Builder lets you assemble a structured AI prompt from your saved account data. It allows you to inject relevant credentials, platform notes, and usage history into a formatted context block for use in AI chat sessions.

Contexts are saved per-session and can be exported as plain text or copied directly into your AI conversation.

Authentication

CoBox requires a verified account. You can sign in using two methods:

Sign in with Google

  • One-click sign-in using your existing Google account
  • Your Google ID token is verified server-side using Google's official library - your credentials are never stored
  • Google OAuth is the recommended and most secure sign-in method

Sign in with Referral Code

  • Enter a valid team referral code to create an account instantly
  • Referral codes may grant an upgraded plan tier, valid for 30 days

Once logged in, your session stays active for 30 days via a secure HttpOnly cookie. You won't need to sign in on every visit. Sessions are automatically invalidated after expiry or on explicit logout.

Plans & Pricing

CoBox offers three tiers. All plans include the same core security and privacy protections.

Free
  • Up to 4 saved accounts
  • Disposable email generation
  • OTP & magic link extraction
  • Shared Vault access
Pro - ₹299/mo
  • Up to 15 saved accounts
  • Everything in Free
  • Priority inbox polling
  • Priority support
Max - ₹499/mo
  • Unlimited saved accounts
  • Everything in Pro
  • Fastest inbox polling
  • Early access to new features
  • Direct support channel

Plans are billed monthly and expire automatically after 30 days. Upon expiry, your account reverts to the Free tier. Upgrade anytime from your account settings. Payments are processed securely by Razorpay.

Security

CoBox is built with security at every layer:

  • Encrypted in transit - All connections use HTTPS/TLS. HTTP requests are automatically redirected.
  • Encrypted at rest - Sensitive fields (mobile number, purpose, account passwords) are encrypted using AES-256-GCM before being stored in MongoDB.
  • HttpOnly cookies - Session tokens are stored in HttpOnly, Secure, SameSite cookies - inaccessible to JavaScript, eliminating XSS session theft.
  • Server-side Google verification - Google OAuth tokens are verified using Google's official library. Client-supplied emails are never trusted without cryptographic proof.
  • Rate limiting - Auth routes: 10 requests per 15 minutes. Payment routes: 5 requests per hour. OTP routes: 30 requests per minute.
  • Razorpay security - Payment signatures are verified server-side using HMAC-SHA256 with timing-safe comparison. Prices are defined server-side - the frontend cannot manipulate amounts.
  • XSS mitigation - All dynamic HTML rendered in the browser is sanitized through DOMPurify.

If you suspect your account has been compromised, contact us immediately at support@aiplex.app to initiate an account freeze.