curl "https://tawked.com/v1/email/received?spam=false&limit=20" \
-H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx"const res = await fetch("https://tawked.com/v1/email/received?spam=false&limit=20", {
headers: {
Authorization: "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx",
},
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/email/received",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.get(
"https://tawked.com/v1/email/received?spam=false&limit=20",
headers={"Authorization": "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx"},
)
data = res.json(){
"data": [
{
"id": "0199f3a1-5c2e-7d40-9a1b-2c3d4e5f6a7b",
"address": {
"id": "0199f2b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"domain": "inbound.acme.sa",
"kind": "domain"
},
"to": [
"orders@inbound.acme.sa"
],
"from": {
"name": "سارة",
"address": "sara@example.com"
},
"subject": "استفسار عن الطلب 1042",
"spam": false,
"has_attachments": true,
"attachments_count": 1,
"size": 48211,
"status": "ready",
"thread": {
"email_id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"received_id": null
},
"received_at": "2026-10-26T09:12:03+00:00"
}
],
"has_more": true,
"next_cursor": "eyJyIjoiMjAyNi0xMC0yNlQwOToxMjowMy4wMDAwMDArMDA6MDAiLCJpZCI6IjAxOTlmM2ExIn0"
}List received emails
Lists the e-mail the application received at its receiving addresses, newest first, a page at a time: follow next_cursor while has_more is true. Metadata only; read one e-mail for its bodies, headers and attachments. Needs a key holding email:inbound, which no key holds unless it was switched on. Only the last 30 days are kept.
curl "https://tawked.com/v1/email/received?spam=false&limit=20" \
-H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx"const res = await fetch("https://tawked.com/v1/email/received?spam=false&limit=20", {
headers: {
Authorization: "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx",
},
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/email/received",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.get(
"https://tawked.com/v1/email/received?spam=false&limit=20",
headers={"Authorization": "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx"},
)
data = res.json(){
"data": [
{
"id": "0199f3a1-5c2e-7d40-9a1b-2c3d4e5f6a7b",
"address": {
"id": "0199f2b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"domain": "inbound.acme.sa",
"kind": "domain"
},
"to": [
"orders@inbound.acme.sa"
],
"from": {
"name": "سارة",
"address": "sara@example.com"
},
"subject": "استفسار عن الطلب 1042",
"spam": false,
"has_attachments": true,
"attachments_count": 1,
"size": 48211,
"status": "ready",
"thread": {
"email_id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"received_id": null
},
"received_at": "2026-10-26T09:12:03+00:00"
}
],
"has_more": true,
"next_cursor": "eyJyIjoiMjAyNi0xMC0yNlQwOToxMjowMy4wMDAwMDArMDA6MDAiLCJpZCI6IjAxOTlmM2ExIn0"
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), email:manage (includes email:send), webhooks:manage, email:inbound, notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. email:manage and webhooks:manage are held only by a key someone chose them for: a full-access key, old or new, never holds them. email:inbound, which reads, deletes and forwards received e-mail, is opt-in on every key, full access included: a key holds it only when it was turned on when the key was created. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Query Parameters
1 to 100 e-mails a page; 20 by default.
The previous page's next_cursor.
One receiving address's id: the e-mail it received.
One address the e-mail was delivered to, exactly (the domain in any case).
One sender address, in any case.
true or false: the e-mail marked as spam, or the rest.
true or false.
An ISO 8601 date and time: e-mail received after it.
An ISO 8601 date and time: e-mail received before it.