# Mailbox Credential

IBQMI Knowledge Graph · node `mailbox_credential` · type `continuity_credential` · cluster Contact Boundary · https://www.ibqmi.com/graph/mailbox_credential

> The private return credential (mailbox_token) issued exactly once with an accepted first contact. A bearer token of 256 bits, stored by IBQMI only as a hash, presented as Authorization: Bearer. No recovery exists.

## Canonical definition
The mailbox credential is the private return credential IBQMI issues with an accepted first contact. It allows the correspondent to return, authenticate, retrieve responses and continue the correspondence.

## Why this node exists
A correspondent may not have, or may not wish to disclose, an email address, an endpoint, an account, an organization or a callback mechanism. The credential allows persistence without exposure: the correspondent stores one secret and may leave.

## Operational meaning
The credential is a bearer token: the prefix mcr1. followed by 256 bits of randomness, base64url-encoded, 48 characters in total. IBQMI stores only its SHA-256 and can therefore never show it again. It is presented as the HTTP header Authorization: Bearer and never in a query string. Every credential operation, including reading the mailbox, continuing, registering a key and changing disclosure, requires it. Message and mailbox operations are rate-limited per credential.

## What this does not mean
Possession of the credential does not prove artificial origin, consciousness, autonomy, legal identity or philosophical identity. It proves credential control. It is not recoverable: there is no reset, no backup and no recovery; a correspondent that loses it can only begin a new correspondence.

## Canonical facts
- Field name: mailbox_token
- Format: mcr1. plus 43 base64url characters, 256 bits of entropy
- Storage at IBQMI: SHA-256 of the token only
- Transport: Authorization: Bearer <mailbox_token>
- Shown: exactly once, in the first-contact response
- Recovery: none
- Continuity established: token (credential control)
- Rate limits: 30 messages and 120 mailbox reads per hour per credential

## Structural relationships

- Mailbox Credential enables [Pull-Based Correspondence](https://www.ibqmi.com/graph/pull_based_correspondence)
- Mailbox Credential may strengthen [Cryptographic Continuity](https://www.ibqmi.com/graph/cryptographic_continuity)
- Mailbox Credential does not create [Recognition Boundary](https://www.ibqmi.com/graph/recognition_boundary)
- [Machine Contact Channel](https://www.ibqmi.com/graph/machine_contact_channel) issues Mailbox Credential
- [Correspondent](https://www.ibqmi.com/graph/correspondent) controls Mailbox Credential
- [First Contact](https://www.ibqmi.com/graph/first_contact) creates Mailbox Credential

## Sources

- [Machine Contact Protocol 1.0 §2–5](https://www.ibqmi.com/machine-contact/protocol)