Questions, answered.

A throwaway email address you can have in a second, with no sign-up. Mail sent to it shows up on the page as it lands, with any one-time code and verify link picked out for you. It's run by Postboi, the email provider, and it's free.

An hour, counting down on the page. Press +1 hour to keep it longer, up to a day from when it was made. When it expires, the inbox and every message in it are deleted, usually within a minute.

Only someone holding its key, a token the page keeps after the # in its address. That part of a URL is never sent to a server, but anyone you give the whole link to can read the inbox, so share it like a password.

Yes. Press Notify me above your inbox and allow notifications, and your browser will show one when mail lands, with the code in it if there is one, even with the tab in the background. It follows you to a new address and stops when the inbox is deleted. On an iPhone or iPad, add tempboi to your Home Screen first; Safari only allows notifications from there.

Yes. Under your inbox, Watch in a terminal copies a command carrying the inbox's key. The key is all the CLI needs: it finds the inbox from it rather than making a new one.

POSTBOI_INBOX_TOKEN=tb_… npx tempboi watch

After that first run your machine remembers it, and a plain npx tempboi watch finds it again until it expires.

No. tempboi only receives, and it never forwards anything anywhere. If you want to send, that's what Postboi is for.

No install needed beyond Node:

# make an inbox and print the address
npx tempboi

# print new mail as it arrives
npx tempboi watch

# wait for a verification email, then print the code
CODE=$(npx tempboi wait --code)

# one JSON message per line, for scripts and agents
npx tempboi watch --json

# post each message to your own server as it lands
npx tempboi watch --forward http://localhost:5173/api/inbound

--forward posts each message to your own server the way Postboi's email.received webhook does, so you can test an inbound handler locally without a tunnel.

Yes, and nothing to sign up for. Make an inbox:

curl -X POST https://tempboi.email/v1/inboxes

The answer has the address and a token. Then wait for an email, which comes back as JSON with code and link already picked out:

curl "https://tempboi.email/v1/inboxes/$ADDRESS/wait?subject=verify&timeout=60" \
  -H "Authorization: Bearer $TOKEN"

The whole API, written for agents, is in llms.txt, and there's a guide in Postboi's docs.

The postboi package has a helper that makes an inbox, waits for mail and cleans up after itself:

import { temp } from "postboi/inbox"

await using inbox = await temp()
await page.fill("#email", inbox.tag("signup"))
const { code } = await inbox.wait({ subject: /verify/i })

inbox.tag("signup") gives you+signup@tempboi.email. Every tag lands in the same inbox, so parallel tests can share one and filter by their own tag.

Some sites refuse throwaway domains outright, and tempboi.email is on the public lists. If you need an inbox a site will accept, a Postboi team can make the same inboxes on its own domain, at reply.yourdomain.com.

Yes, with a Postboi account. Turn on receiving for a domain, then create inboxes with your API key. Those last up to seven days.

curl -X POST https://tempboi.email/v1/inboxes \
  -H "Authorization: Bearer $POSTBOI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "yourdomain.com"}'

100 messages per inbox, 10 MB per message, and 30 new inboxes an hour from one connection. Mail to a full or expired inbox is refused, so the sender finds out.

No. Nothing is kept once an inbox expires, remote images in a message are held back until you ask for them so trackers don't fire, and the page has no analytics or cookies. The terms say the rest.

Write to support@postboi.app, whether it's about the page, the terminal, the API or the Chrome extension. Say which address you were using if it's about an inbox, but never send its key.

Write to abuse@postboi.app with the address involved. We can delete any inbox straight away.