# tempboi.email > Throwaway email inboxes with no account, made for developers, tests and agents. Create one > with a POST, give its address to whatever sends a verification email, then wait for that > email and read the code or link straight out of the JSON. Run by Postboi (https://postboi.app). ## Create an inbox POST https://tempboi.email/v1/inboxes Body (all optional): {"name": "signup", "ttl": "15m"} → 201 {"address", "token", "expires", "cursor", "urls": {"web", "messages", "wait"}} The token (tb_…) is shown once and is the only way to read the inbox. Send it as `Authorization: Bearer tb_…` or `?token=tb_…`. ttl is seconds or "90s" / "15m" / "2h" / "1d"; 1h by default, a day at most. `name` gives signup-xxxx@tempboi.email instead of two random words. Plus-addressing: address+anything@tempboi.email lands in the same inbox with tag "anything". Use a tag per test run and filter by it. ## Wait for an email GET https://tempboi.email/v1/inboxes/{address}/wait?tag=&from=&subject=&timeout=60&after= → 200 the newest matching message (one that already arrived counts), or 408 {"code":"timeout","cursor"} Filters are case-insensitive substrings; tag is exact. Pass `after` (a seq) to insist on newer mail. ## Read messages GET https://tempboi.email/v1/inboxes/{address}/messages?after={cursor}&wait=25 → {"data": [message…], "cursor"} — oldest first; `wait` long-polls up to 25s for new mail. Loop with the returned cursor to watch an inbox live. GET https://tempboi.email/v1/inboxes/{address}/messages/{id} the full message, html and headers included GET https://tempboi.email/v1/inboxes/{address}/messages/{id}/raw the .eml as it arrived GET https://tempboi.email/v1/inboxes/{address}/messages/{id}/attachments/{n} A message: {"id", "seq", "to", "tag", "from", "from_name", "subject", "text", "html", "received", "code", "codes", "link", "links": [{"url", "text", "kind": "verify|unsubscribe|other"}], "auth": {"spf", "dkim", "dmarc"}, "attachments", "size", "truncated", "avatar", "logo"} `code` is the most likely one-time code and `link` the most likely verify / sign-in link, with click-tracking redirects removed. html is as received and not sanitised. `avatar` is the sender's Gravatar (it 404s when they have none); `logo` is their BIMI mark as a data URI, set only when the message passed DMARC at a domain enforcing it that publishes a BIMI record with a mark certificate. ## Notifications POST https://tempboi.email/v1/inboxes/{address}/push a browser's PushSubscription JSON ({ endpoint, keys }) DELETE https://tempboi.email/v1/inboxes/{address}/push { "endpoint": "…" } The browser is sent a Web Push notification whenever mail lands, with the code as its title when there is one, and clicking it opens that message. One browser follows one inbox; filing it again moves it. ## Manage GET https://tempboi.email/v1/inboxes/{address} the inbox GET https://tempboi.email/v1/inboxes the inbox the token opens, found by the token alone PATCH https://tempboi.email/v1/inboxes/{address} {"ttl": "1h"} live longer (within a day of creation) DELETE https://tempboi.email/v1/inboxes/{address} delete it and everything in it now ## From a terminal npx postboi inbox make one npx postboi inbox wait --code print the next code and exit (exit 2 on timeout) npx postboi inbox watch --json NDJSON, one message per line ## Limits 100 messages per inbox, 10 MB per message, 30 new inboxes per hour from one IP. Receive only: nothing can be sent from these addresses. Abuse: abuse@postboi.app ## On your own domain A Postboi team with receiving turned on for a domain can make the same inboxes at reply.: POST /v1/inboxes with the team's API key as the bearer and {"domain": ""}. They last up to 7 days. https://docs.postboi.app/temp-inbox