# receivemail.dev

> A real inbox for your test suite. POST to create a disposable email address, no signup, then poll it for whatever lands there.

Built for the same audience as sms-florin (QA/dev, AI agents testing signup flows) — a throwaway inbox instead of a throwaway phone number.

## How it works

- `POST /mailboxes` — creates a random address (default 15min TTL, max 60min) and returns `{address, expiresAt, secret}`. No token required to create one.
- `GET /mailboxes/:address/messages` — returns the last 50 messages for that address (`from_address`, `subject`, `body_text`, `received_at` in ISO 8601 UTC), authenticated with `Authorization: Bearer <secret>` using the mailbox's own `secret` from creation. Only reserved addresses can be read. Plain-text body only (no HTML, no attachments); mail is kept about 24h.
- `GET /mailboxes/:address/wait?timeout=25&since=<ISO>` — long-poll: returns the newest message newer than `since` as soon as it arrives, or `{"timed_out":true}` after `timeout` seconds (max 25). Same secret. Call again on timeout.
- Free, no signup, no API key. FAQ (Playwright/Cypress recipes, limits, retention): https://receivemail.dev/faq
- Rate limited: 20 creates/min/IP, 5,000 creates/day globally.

## Paid plans (optional)

- Pro, $7/mo: send `Authorization: Bearer rmk_...` on `POST /mailboxes` — mailboxes up to 24h (`ttlMinutes` up to 1440), 120 creates/min per key instead of the per-IP limit, and each message from `GET /mailboxes/:address/messages` includes an extracted `otp` field.
- Pro + Webhooks, $19/mo: everything in Pro, plus pass `webhookUrl` (public https) when creating a mailbox and every incoming email is POSTed there as JSON `{address, from, subject, bodyText, otp, receivedAt}`, signed with `X-Receivemail-Signature` = hex HMAC-SHA256(your API key, raw body).
- Subscribe on https://receivemail.dev/#pro — the API key is shown right after checkout.

## Docs

- [Landing page / quickstart](https://receivemail.dev/): curl examples, full endpoint reference.
- [Testing email verification flows in CI](https://receivemail.dev/guides/testing-verification-emails)
- [Getting verification codes without regex or polling (otp field, webhooks)](https://receivemail.dev/guides/email-otp-webhook)

## Related

- [sms-florin](https://flo-voice1.com/llms.txt): the phone-number rental service this shares its audience with — same "receive something, expose via API" pattern for SMS instead of email.
- [otp-watch](https://otpwatch.flo-voice1.com/llms.txt): synthetic monitoring built on top of both this and sms-florin, confirming an OTP/verification code actually arrives.
- [mcp-ssrf-scan](https://mcpscan.flo-voice1.com): static SSRF/secrets scanner for MCP servers, with optional CI scan history.