API Reference

FastTempMail API

Create disposable inboxes, read mail as JSON, and stream new messages — for testing signup flows, OTP verification, and automation. API keys are issued to approved accounts.

Authentication

The API uses two credentials. Your API key (header X-API-Key) authenticates your account and is required to create inboxes. Creating an inbox returns a readToken — a per-inbox credential you pass as Authorization: Bearer to read, stream, or delete that inbox.

Base URL: https://api.tempxzy.net/headless

Quickstart

1 · Create an inbox

curl -X POST https://api.tempxzy.net/headless/emails \
  -H "X-API-Key: $FASTTEMPMAIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "lifespanMinutes": 60 }'

# 201 Created
# {
#   "id": "aZ3kQ",
#   "email_address": "abc.12345@tempxzy.net",
#   "expires_at": "2026-07-24T12:34:56.000Z",
#   "readToken": "rd_9f2c..."
# }

2 · Read what it received

curl https://api.tempxzy.net/headless/emails/$ID \
  -H "Authorization: Bearer $READ_TOKEN"

# 200 OK
# {
#   "emails": [
#     { "id": 42, "content": "<raw MIME / decrypted body>", "created_at": "..." }
#   ],
#   "total": 1, "page": 1, "limit": 10, "totalPages": 1
# }

Endpoints

POST/headless/emailsX-API-Key

Create a disposable inbox. Body: { customPrefix?, lifespanMinutes? } (6–4320 min).

GET/headless/emails/:idBearer readToken

List received emails, paginated (?page & ?limit).

GET/headless/emails/:id/streamBearer readToken

SSE stream — emits a "new-email" event when mail arrives.

PATCH/headless/emails/:id/expirationBearer readToken

Extend expiry. Body: { newLifespanHours } (≤72).

DELETE/headless/emails/:idBearer readToken

Delete the inbox and all its messages.

Real-time delivery

Open an SSE connection to /emails/:id/stream and you'll get a new-email event the instant mail arrives — then fetch it. Outbound webhooks (we POST each email to your endpoint) are rolling out for paid plans, so you never have to poll in CI.

Rate limits

Requests are limited per API key on a rolling window, sized to your plan. Exceeding it returns 429 with a Retry-After header.

Errors

Standard HTTP codes: 400 invalid input, 401 bad key/token, 429 rate limited, 500 server error. Bodies are JSON with an error field.

Get an API key

Keys are issued to approved accounts as we roll out. Join the waitlist and we'll send yours.

No spam. Just one email when your access is approved.