Getting started

Ayoh is mail, boards, notes, a calendar, contacts, digests and an AI agent in one app, with your data in your own Cloudflare account. Setting up takes four steps: connect Cloudflare, create a workspace, connect a domain, create an address. Most people receive their first message within minutes of finishing.

Before you start #

• A Cloudflare account (free) on the Workers Paid plan ($5 a month, billed by Cloudflare).
• A domain on that account. Ayoh receives mail through Cloudflare Email Routing and sends through Cloudflare Email Service, so the domain has to be on Cloudflare. Already own one elsewhere? Adding it is free: Cloudflare shows two nameservers to put in at the company you bought it from. No domain yet? Cloudflare sells them at the registry's price, from about $10 a year.
• If a domain already receives mail somewhere else (Google Workspace, Fastmail, your own server), you can still use it: Ayoh connects a subdomain such as mail.example.com and leaves the existing mail alone, or takes the whole domain over if you ask it to.
• A current browser. Ayoh is a cloud app, so there is nothing to download. Once you are in, you can add it to your phone's home screen or your computer's dock: see Ayoh on your devices.

1. Connect Cloudflare, then create a workspace #

Open Ayoh and choose Get started. The first thing it asks for is a Cloudflare API token — before the workspace, not after. Ayoh runs inside your own Cloudflare account, so a token is what setup needs anyway, and Cloudflare confirming it is what tells Ayoh there is a real account behind the form.

If you do not have a Cloudflare account yet, No, not yet lists the three things to do there and what each costs: the account is free, a domain already yours is free to add (a new one is billed yearly by Cloudflare), and the Workers Paid plan is $5 a month, billed by Cloudflare. Ayoh itself adds nothing.

Open Cloudflare opens Cloudflare with the name and every permission pre-selected: Continue to summary, Create Token, copy. Paste it back and Ayoh checks it on the spot, listing what it can and cannot do. A token that is missing a permission does not stop you — you can continue and fix it in Settings → Cloudflare — but one Cloudflare refuses outright does.

Then the workspace itself. A workspace is your account: it owns your mailboxes, your domains and your boards.

Workspace name

Any name up to 80 characters. It is shown in the app; usually your company or your own name.

Your email

How you sign in on a new device. Not your new mailbox — an address you already read.

Passkey

Create with a passkey asks your device for your fingerprint, face or PIN, and that is the workspace made. There is no password to choose, and nothing is created until the device answers.

The screen straight after asks you to confirm that email with a six-digit code. It is where a code goes if you ever lose the device holding your passkey, and you can change it later in Settings → General.

2. The Cloudflare token, in full #

The token is asked for at the very start of sign-up, above — this section is what it is for, what each permission does, and where to change it afterwards (Settings → Cloudflare). Only you can create one, and it is three clicks:

1. 1Press Open Cloudflare. Cloudflare's token form opens in a new tab with the name (Ayoh), the permissions and all your zones pre-selected. Sign in to Cloudflare if it asks, and check they are all listed (if one is missing, press + Add more and pick it).
2. 2In Cloudflare, press Continue to summary, then Create Token. (Cloudflare may show these buttons in your own language.)
3. 3Copy the token Cloudflare shows (it is shown only once) and paste it into the Paste the token box, then press Connect Cloudflare.

Ayoh asks Cloudflare whether the token is active, confirms it can list your zones, and probes its edit permissions against one of your zones (a connected one when there is any). The Email Routing Rules check is a real write: it re-saves that zone's catch-all rule unchanged, so a token that can only read rules is caught here rather than when a domain is connected. The token is stored encrypted. It is used to install Ayoh in your account, to connect domains and to apply updates; running the app day to day does not need it, so you can revoke it once setup is done and paste a fresh one when you next update.

Account → Email Sending → Edit

Sending from your domain.

Zone → Zone → Read

Listing your domains.

Zone → Zone Settings → Edit

Switching Email Routing on.

Zone → Email Routing Rules → Edit

Routing inbound mail to Ayoh.

Zone → DNS → Edit

Publishing SPF, DKIM and DMARC records for you.

Account → Workers Scripts → Edit

Running the app in your account.

Account → D1 → Edit

Creating your database.

Account → Workers R2 Storage → Edit

Creating your mail storage.

Zone → Workers Routes → Edit

Serving the app on your domain.

Prefer to make the token by hand? In Cloudflare go to My Profile → API Tokens → Create Token → Custom token, add every permission listed above, and under Resources include your account and the zones you want to use.

3. Connect a domain #

The wizard lists every zone the token can see, with the account it belongs to and its status. Zones whose root already has other mail servers are marked mail hosted elsewhere. Press Connect on a zone and choose where addresses should live:

• The whole domain (@example.com): Cloudflare handles all of the domain's incoming mail. When the domain already has other mail servers the button reads Take over instead: Ayoh removes the MX records pointing at the old provider and adds include:_spf.mx.cloudflare.net to the existing SPF record, so all mail for the domain moves to Ayoh as DNS caches expire. Every other record, and the mail already stored at the old provider, stays as it is. You have to tick a confirmation first; the subdomain below stays the default for such a domain.
• A subdomain (@mail.example.com by default): your existing mail on the domain keeps working exactly as it is. The label may be 1 to 63 letters, digits and dashes, starting and ending with a letter or digit.

Several zones to connect? Connect all connects every active zone in one go: the whole domain where it is free, a mail. subdomain where mail is hosted elsewhere. It never takes a domain over. Each zone reports its outcome under its row, and one that failed can be connected on its own afterwards.

Press Connect @… and Ayoh runs six setup steps against Cloudflare. Each step reports what it did:

Email Routing enabled

Switches Email Routing on for the domain (or registers the subdomain) and adds any DNS records Cloudflare reports as missing. When taking a domain over, it first removes the other provider's MX records.

Catch-all rule → Ayoh worker

Points the domain's catch-all rule at Ayoh so every address on the domain reaches it. See Catch-all email on Cloudflare.

SPF record

Adds v=spf1 include:_spf.mx.cloudflare.net ~all when the domain has no SPF record. If it has one that does not include Cloudflare, the step asks you to add the include yourself, except when taking a domain over: then it adds the include to the existing record itself.

Email Sending (outbound) onboarded

Registers the domain with Cloudflare Email Service so you can send.

DKIM + return-path records

Publishes the signing and return-path records Cloudflare hands back. Waits while the previous step is unfinished.

DMARC policy

Keeps an existing DMARC record, or creates a monitoring policy (p=none) that reports to postmaster@ your domain. Tighten it to quarantine or reject once mail flows.

• A green check means done. A red mark is an error, with the reason. An amber mark means the token lacks a permission: the detail names it. Press Fix the token to add it in Cloudflare or create a new token; setup re-runs on its own afterwards.
• The domain shows Ready once routing and the catch-all rule are in place and no step is red or amber; until then it shows Needs attention (or Provisioning while it runs). Re-running is safe at any time: finished steps stay finished, and every record Ayoh creates carries the DNS comment Managed by Ayoh.
• Connect as many domains as you like, now or later from Settings. A zone can belong to only one workspace.

4. Create an address #

Pick the domain, type the part before the @, and optionally a display name (the name people see on mail you send). Tick catch-all if this address should also receive mail sent to any other address on the domain. Press Save and you land in its Inbox.

• An address is 1 to 64 characters of lowercase letters, digits, dots, dashes and underscores, starting and ending with a letter or digit.
• Plus-addressing works without any setup: mail to hello+shop@example.com arrives in hello@example.com.
• Mail to an address that has no mailbox, on a domain without a catch-all, is refused at delivery with 550 No such mailbox, so the sender gets a bounce rather than silence.
• Every address you add receives into the same inbox, and keeps its own display name and AI settings. Add more at any time from Settings → Addresses — or an alias, which is another address to be reached at that files into one of them.

Your first email #

Send yourself a message from another account. It appears within seconds. If the live connection drops, an amber or red dot appears in the window's top right corner until it is back; while it is up there is nothing to see. About a second after a message arrives, Ayoh writes its one-line summary and, when the message was written by a person, drafts a reply into Drafts. Nothing is sent unless you press Send.

Where things are #

On a computer the apps are down the rail on the left; on a phone they are the tabs along the foot, with More for the rest. Getting around explains the rail, the tab bar, the drawers and search, with pictures of both.

Press ? at any time for the keyboard shortcuts.