BUILD. TEST. VERIFY.

Free email testing API without signup

InboxIt provides temporary, receive-only email inboxes for automated testing. No account, session, domain setup or CLI is required. A secret token grants access to one inbox.

Each inbox lasts 24 hours from creation, with up to 100 incoming emails and 10 MB. Create up to three per network per UTC day, with no more than three active. Browser and API creations share these limits. There is also a service-wide daily capacity limit; a 429 response means you must wait or use an authenticated workspace. The service is receive-only.

1. Create your test inbox

Run this in Node.js 20+ or another server-side HTTP client. Use a fresh random idempotency key per inbox; reuse that same key when retrying creation from the same network. A pending inbox is still provisioning: poll GET until status is active before triggering your app.

const base = 'https://inboxit.wtf/api/v2/public/inboxes';
const response = await fetch(base, {
  method: 'POST',
  headers: {'Idempotency-Key': crypto.randomUUID()}
});
if (!response.ok) throw new Error('Create failed: ' + response.status);
const {token, inbox} = await response.json();
// Keep token private. Use inbox.address in your test application's signup.
const headers = {Authorization: 'Bearer ' + token};

2. Trigger your application's email

Use inbox.address in a signup, password-reset or invitation flow you control. Wait for inbox.status to become active. A temporary address does not send email itself, and some applications may reject temporary domains.

3. Wait for the message

const deadline = Date.now() + 120_000;
let email;
while (Date.now() < deadline) {
  const r = await fetch(base + '/wait?timeout=20&subject=Verify', {headers});
  if (r.status === 429) {
    await new Promise(resolve => setTimeout(resolve, 5000));
    continue;
  }
  if (!r.ok) throw new Error('Read failed: ' + r.status);
  const result = await r.json();
  if (result.status === 'matched') { email = result; break; }
  await new Promise(resolve => setTimeout(resolve, 5000));
}
if (!email) throw new Error('Verification email did not arrive in time');
// email.message contains text and HTML; email.extraction contains codes and links.

sender and subject are case-insensitive substring filters, not proof of sender identity. after is a numeric message ID: pass the last processed ID to skip earlier mail. timeout is 1–20 seconds per request. A waiting response is normal; retry after five seconds with your own overall deadline.

4. Read, then delete

const list = await fetch(base, {headers}).then(r => r.json());
// list.inbox includes expires_at, messages_remaining and storage_remaining.
const message = await fetch(base + '/messages/' + email.message.id, {headers});
await fetch(base, {method: 'DELETE', headers});

Endpoint reference

All requests after creation require Authorization: Bearer TOKEN. Tokens cannot send mail or access another inbox. No cross-origin browser access is enabled; call from your server or use the tool page.

Errors and safe retries

400: correct your inputs. 401: missing or invalid token. 404: no such message. 410: expired, deleted or claimed inbox—create a new inbox with a new key. 429: respect Retry-After and reduce polling. 503: temporary service issue; retry with backoff. Creation retries do not extend expiry. Read requests are limited to 120 per network per minute and one simultaneous wait per inbox.

Is this separate from the free account plan?

Yes. Guest limits are independent of signed-in allowances. For team workflows, owned domains or persistent account access, use authenticated testing and your plan's retention policy.

Privacy and expiration

The address is not a public mailbox: reading requires its secret bearer token, or its browser-only cookie. Anyone holding that secret can read the inbox. Never put it in a URL, repository, screenshot or agent trace. This is not end-to-end encryption. At expiry, access and receiving stop; the cleanup worker removes mailbox contents. Encrypted backups follow the backup retention policy. Do not use temporary addresses for sensitive or lasting account access.