# Showing customer avatars in a CRM or support inbox

> Turn a list of email addresses into faces and company logos: what to look up, how to handle privacy, and how to keep it fast.

Published 2026-10-19 · https://avatarsapi.com/blog/avatars-in-crm-support-inbox

A support inbox or CRM full of grey circles is harder to scan than one with faces and logos. Your records usually have an email address and sometimes a company domain or a social handle. Here is how to turn those into pictures.

## What to look up, in order

1. **The person, by email.** Gravatar covers people who signed up for it; GitHub covers many developers. Check both.
2. **The company, by email domain.** If the person has no picture, a work email still says where they work. A company's [BIMI](/blog/company-logo-from-email-domain-bimi) logo, or failing that its favicon, beats a grey circle.
3. **A social handle, if you have one.** Many CRMs store an X, LinkedIn, or GitHub handle.
4. **Initials**, when everything else misses.

avatarapi's `/email/:address` does steps 1 and 2 in one request: it races Gravatar and GitHub, then falls back to the domain's BIMI logo.

```html
<img src="https://avatarsapi.com/email/jane@stripe.com?size=64" alt="">
```

Skip the domain fallback for free mail providers (gmail.com, outlook.com): a Gmail logo next to a customer is noise. Check the domain before you render and go straight to initials for those.

## Privacy: keep raw emails out of URLs

An email in an image URL can end up in browser history, proxy logs, and `Referer` headers. Two mitigations:

- **Send a hash.** `/email/` also accepts the lowercase SHA-256 (or MD5) hex of the address. Only Gravatar can be checked from a hash, so you trade coverage for privacy.
- **Set a referrer policy.** `<meta name="referrer" content="strict-origin-when-cross-origin">` (the browser default today) keeps the full URL out of cross-site `Referer` headers.

Unsalted hashes are not anonymous, since common addresses can be guessed, but they do keep plain addresses out of logs.

## Keep it fast

- Request the size you render (`?size=64` for a 32 px avatar on retina) so you are not downloading 400 px images for a list.
- Add `loading="lazy"` so a long inbox only loads visible rows.
- Repeat views are free: responses are cached at the edge and in the browser, and cached images never count toward usage.

## Pick a Plan that fits a real inbox

Anonymous use is for trying it out. A CRM shows the same faces all day to many agents, so put it on a Project: free Projects come with a browser-safe `pk_` key and a daily allowance, and Starter removes the daily cap and the attribution link. See [current limits](https://avatarsapi.com/docs#plans).

```html
<img src="https://avatarsapi.com/p/pk_…/email/jane@stripe.com?size=64" loading="lazy" alt="">
```

## Related

- [A React avatar component with a real fallback](/blog/react-nextjs-avatar-component)
- [Gravatar alternatives](/blog/gravatar-alternatives)