JSON APIFree · no key needed

Temporary email, from a script

The Temp Mail page has an API behind it. Create a disposable address, poll it, and read the full message — headers, plain text, sanitised HTML, every attachment, and the verification code already lifted out for you — as plain JSON. It is the same mailbox the page shows and the same backend that stores it, so a code your script reads is a code that really arrived.

Open the reader Quick start

Reference

Base URL and authentication

Base URL

Base

https://inboxview.xyz/api/v1/temp

Every path below is appended to it. The API is on the same origin as this site, over HTTPS, and it takes and returns JSON only.

Authentication

None needed today: the endpoints are open and rate-limited per IP, exactly like the free tools. If you have been issued a key, send it and it will be used — expired or disabled keys are rejected rather than ignored.

Only if you have a key

Authorization: Bearer ivx_live_xxxxxxxxxxxxxxxx

Two calls

Quick start

Create an address, give it to whatever is about to email you, then poll the list. Polling is the supported pattern: a verification mail normally lands within a few seconds, so a two-second interval with a one-minute ceiling is enough for almost every signup flow.

1 — Create a disposable address

Request

curl -s -X POST "https://inboxview.xyz/api/v1/temp/inboxes/random"

# Answers:
# {
#   "address": "[email protected]",
#   "domain": "mailbox-one.com",
#   "availableDomains": ["mailbox-one.com", "mailbox-two.net"],
#   "ttlHours": 72,
#   "message": "Anything sent to this address lands in this mailbox. Poll or open the reader."
# }

Nothing is stored by this call — an address exists the moment it is named, so creation is free and repeatable. Pick your own name with POST /inboxes?local=my-name&domain=mailbox-one.com.

2 — Poll for the message

Request

curl -s "https://inboxview.xyz/api/v1/temp/inboxes/[email protected]/messages?limit=10"

Response

{
  "address": "[email protected]",
  "count": 1,
  "unread": 1,
  "expiresAt": "2026-10-13T09:41:12.000Z",
  "empty": false,
  "messages": [
    {
      "id": "0f3c9b2e-...",
      "from": "Example <[email protected]>",
      "subject": "Your verification code",
      "receivedAt": "2026-10-10T09:41:12.000Z",
      "seen": false,
      "preview": "Your code is 483920. It expires in 10 minutes.",
      "code": "483920",
      "hasAttachments": false,
      "attachmentCount": 0,
      "sizeBytes": 18422
    }
  ]
}

code is the part most automations want — it is already extracted from the subject and body, and sometimes there is no code at all, so treat null as a normal answer rather than an error.

3 — Fetch the full message

Request

curl -s "https://inboxview.xyz/api/v1/temp/inboxes/[email protected]/messages/0f3c9b2e-..."

Response (abridged)

{
  "id": "0f3c9b2e-...",
  "from": "Example <[email protected]>",
  "fromAddress": "[email protected]",
  "fromName": "Example",
  "to": "[email protected]",
  "replyTo": "[email protected]",
  "subject": "Your verification code",
  "receivedAt": "2026-10-10T09:41:12.000Z",
  "seen": true,
  "code": "483920",
  "text": "Your code is 483920. It expires in 10 minutes.",
  "html": "<div>Your code is <b>483920</b></div>",
  "headers": {
    "message-id": "<[email protected]>",
    "date": "Sat, 10 Oct 2026 09:41:12 +0000",
    "reply-to": "[email protected]"
  },
  "attachments": [
    {
      "index": 1,
      "filename": "invoice.pdf",
      "contentType": "application/pdf",
      "size": 52320,
      "url": "https://...signed..."
    }
  ],
  "rawUrl": "https://...signed...",
  "sizeBytes": 18422,
  "expiresAt": "2026-10-13T09:41:12.000Z"
}

html is sanitised server-side before it ever reaches you, so rendering it is not the same risk as rendering an arbitrary email. The attachments[].url and rawUrl are short-lived signed links — fetch them within a few minutes, and never store them as if they were permanent.

Reference

All endpoints

POST/api/v1/temp/inboxes?domain=&local=Name a mailbox. Nothing is stored — the address works the moment mail is sent to it.
POST/api/v1/temp/inboxes/random?domain=A ready-made address, so a client never has to invent a name.
GET/api/v1/temp/inboxes/{address}/messages?limit=The message list, newest first, with unread count and an expiry timestamp.
GET/api/v1/temp/inboxes/{address}/messages/{id}The full message: headers, text, HTML, attachments, the lifted code, and a signed link to the original.
POST/api/v1/temp/inboxes/{address}/messages/{id}/readMark one message as read.
DELETE/api/v1/temp/inboxes/{address}/messages/{id}Delete one message and everything stored with it.
DELETE/api/v1/temp/inboxes/{address}Empty the whole mailbox.

Rate limit: 120 requests per minute per IP. A {address} in a path contains @ and dots — URL-encode it if your HTTP client is strict.

Reference

Error codes

Code	HTTP	Meaning
INVALID_ADDRESS	400	The address is not in the form name@domain.
NO_DOMAINS	503	No mailbox domain is available right now — retry later.
MESSAGE_NOT_FOUND	404	The message was deleted or expired. This is normal for a disposable mailbox.
API_KEY_REQUIRED	401	This deployment requires a key. Send it in the Authorization header.
API_KEY_INVALID	401	The key is unknown, disabled or expired.
UNKNOWN_DOMAIN	403	Mail is not accepted for that domain.

Before you build

Two things worth knowing

There is no send endpoint

These domains receive and never send. That is deliberate and permanent: a domain that cannot send cannot be turned into a spam relay, and that is what keeps the mailboxes working. If your flow needs to reply, use a real mailbox for that half.

Mail is temporary by design

Every message carries an expiresAt and is deleted automatically — currently 72 hours. Read a message when you need it and store what matters on your side; do not treat this as a mailbox that keeps history.

Want to see it working first?

The reader is the same mailbox the API serves — open it, send yourself something, and watch the JSON match.

Temp Mail