4-hour build log #1: an email API with sign-in and card payments, from the first commit

The brief fitted in six bullet points. A small email API for app developers and bots. No subscriptions: buy credits and use them. Bots should be able to sign up and start sending on their own. Unsubscribe lists, a blocklist and address validation built in. A site that explains it without sounding like a bank.

Harish wrote that brief and made the calls along the way. An AI build agent wrote the code, the tests and the docs, and ran the deploys. This is the log of that evening, taken from the git history of email59.com, because a commit has a timestamp nobody can argue with.

0:00 to 0:19: something real, on the internet

The first commit already had a working API: sign-up, credits, validation, a blocklist, unsubscribe lists and sending, with 31 passing tests, a landing page, docs and an llms.txt file so AI assistants can read what the API does. Nine minutes later sending went through a real email gateway. At eleven minutes it was running on our server behind nginx, with 40 tests passing there.

Then the first bug a person would notice: on a 390-pixel phone the docs page scrolled sideways, because one long code block stretched the grid. Fixed at 0:19, after a visual check on a real phone-sized screen. Nobody would have caught that from the tests.

0:32 to 1:50: taking money without taking chances

At 0:32: passwordless sign-in through our shared login service, an account page, and credit packs paid through Stripe Checkout. There's no subscription anywhere: a pack is a one-time payment, and there's nothing to cancel.

Payments got two more passes. The script that stores the Stripe key on the server was cut down to ask for one secret only. And at 1:35 the webhook was changed to fulfil only the order its checkout session was created for, so a replayed or mismatched event can't hand out credits twice. That's a one-line rule that's easy to skip on a deadline and expensive to learn about later.

At 1:50 the pricing changed. Not because of a bug: Harish decided the free tier should be 200 emails a day, renewed daily. A build where the owner can change the business model at hour two and see it live a few minutes later is the point of working this way.

2:57: bots sign themselves up

The last piece of the brief. A bot posts an email address, receives a code, posts the code back and gets a session key. No browser, no dashboard, no human. The same commit added an MCP server, so AI agents can send email, check addresses and manage lists as tools.

What didn't go to plan

The code was stuck on one machine. We build on two computers. The first commits existed only on the one that wrote them, and the GitHub repository was still empty, so the first deploy attempt found nothing to deploy. Pushing it unblocked the deploy, but it cost time that had nothing to do with code.

A secret ended up in a log. The email gateway's key contains a space. The start script read the config file without quotes, so the first restart printed part of the key into the server's error log. We deleted the line, quoted the values and noted the trap for every app on that server. The key never left the server, but it's exactly the kind of mistake that happens at speed.

The database move didn't fit. The first version stored data in SQLite so it could be built and tested without touching shared infrastructure. Moving it to our shared PostgreSQL database, with its own tables and a test database, landed at 4:56. Outside the four hours, and we'd rather say so than redraw the line.

What four hours bought

A live product with an API, docs, sign-in, card payments, a webhook that can't double-credit, a free tier, bot self-sign-up and an MCP server. Since then it has picked up a free deep email check, 21 articles and a refund and consent step before every payment. The core still is what was built that evening.

What four hours did not buy: a security review by someone other than the builder, load testing, or a designer's pass on the site. Those are separate jobs, and a fast build doesn't make them go away.

Want to see your own idea built like this?

agentZ is how we open this way of working to everyone. You describe the app, the agent asks its questions, shows a mockup for you to approve, then builds while you watch the preview. Agent time is $5 an hour, bought in $5, $10 or $15 packs. No subscription, and the code is yours.

Sources

Commit history of the email59.com repository, 4-5 October 2026 (first commit 20:57 local time; bot sign-up and MCP at 23:54; database move at 01:53). The product: email59.com and its docs. Hero photo from Pexels (Pexels License).