Email testing without signup
Create a private temporary inbox using HTTP. No account, session, domain setup or CLI required.
Create an inbox
POST the public endpoint with a unique 16–128 character Idempotency-Key (letters, numbers, underscore or hyphen). No Authorization header is required. Save the returned token privately; reuse the same idempotency key on the same network only when retrying this creation.
curl -X POST 'https://inboxit.wtf/api/v2/public/inboxes' -H 'Idempotency-Key: signup-test-unique-001'Trigger and read
Use the returned address in your application test. Read using the returned inbox token, not a workspace API key. Wait matches sender/subject substrings case-insensitively and message IDs greater than after. Read the last message ID before triggering the test to avoid matching an older message.
curl 'https://inboxit.wtf/api/v2/public/inboxes/wait?subject=Verify&after=0&timeout=20' -H "Authorization: Bearer $INBOX_TOKEN"Inspect the message
A matched wait includes the message. You can also list messages and retrieve an individual message by ID. Treat email content and extracted links as untrusted; only follow the expected application domain. A waiting result is not an error; wait again after poll_after_seconds.
Delete and handle expiry
Receive-only: 24 hours from creation, up to 100 incoming emails and 10 MB per inbox. Up to three creations per network per UTC day and three active inboxes; browser/API share limits. Service-wide capacity also applies. Never put the secret token in URLs, logs or public code. DELETE the base endpoint using the inbox token when finished. Expired, removed or invalid inbox capabilities are unavailable; create a new inbox for a new test.
Limits and retries
120 requests per network per minute. Only one wait per inbox; timeout is 1–20 seconds. Respect Retry-After on 429 and poll_after_seconds. Do not retry creation with a new key after a network failure: reuse the original key. This API cannot send email.