InboxDome API

Test email flows in CI: create a test inbox, trigger your signup or password-reset, wait for the message, extract the verification code, assert. One HTTP call each.

Get an API keyOpenAPI specUsage dashboard

1. Get a key (free)

Key only: 100 inbox tests/month (20/day), 30 requests/min, 1 webhook. Connect a free DevDome account to lift all of those. Your key is shown only once, so store it safely. Guides: Playwright ·Cypress · Node ·Python · PHP ·MCP (AI agents) · GitHub Actions ·WordPress

2. Create an inbox

curl -X POST https://inboxdome.com/v1/inboxes \
  -H "Authorization: Bearer idk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"domain":"smart","ttlSeconds":3600}'

# → {"inbox":{"id":"inb_...","emailAddress":"h4x8s2kq@mail.inboxdome.com",...}}

3. Wait for the OTP

# Blocks up to 30s until a verification code arrives
curl "https://inboxdome.com/v1/inboxes/inb_.../wait?for=otp&timeoutSeconds=30" \
  -H "Authorization: Bearer idk_live_..."

# → {"message":{...},"otp":{"value":"482913","confidence":0.95}}

4. Read messages & attachments

GET /v1/inboxes/{id}/messages                    # newest first, cursor pagination
GET /v1/inboxes/{id}/messages/{messageId}        # text, sanitized HTML, OTP, links
GET /v1/inboxes/{id}/messages/{mid}/attachments/{attId}   # binary download
DELETE /v1/inboxes/{id}                          # immediate purge

5. Signed webhooks

POST /v1/webhooks {"url":"https://ci.example.com/hook"}   # secret returned once

# Every message.received POST carries:
#   X-InboxDome-Event: message.received
#   X-InboxDome-Event-Id: whd_...            # immutable; dedupe retries on it
#   X-InboxDome-Timestamp: unix seconds
#   X-InboxDome-Signature-Version: v1
#   X-InboxDome-Signature: hex(HMAC-SHA256(secret, timestamp + "." + body))
# Verify constant-time; reject timestamps older than ~5 min (replay window).
# Failed deliveries retry automatically (5 attempts). Delivery log: GET /v1/webhooks/deliveries
# Manual replay: POST /v1/webhooks/deliveries/{id}/replay

6. Email assertions

# Wait for the email AND verify it in one call
curl -X POST https://inboxdome.com/v1/inboxes/inb_.../assert \
  -H "Authorization: Bearer idk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"timeoutSeconds":45,"assertions":[
        {"type":"otpPresent"},
        {"type":"containsText","text":"Welcome"},
        {"type":"linkResponds","urlContains":"verify"},
        {"type":"auth","check":"dkim"}]}'

# → {"passed":true,"arrived":true,"arrivalSeconds":2.1,"results":[...]}
# Save a named set once (POST /v1/scenarios), then POST /v1/scenarios/{id}/run per test.

7. Testing platform

• MCP server. Point any AI coding agent athttps://inboxdome.com/mcp and it can create inboxes and read OTPs while testing your app. Setup →
• GitHub Action. Create, wait and assert steps for CI signup tests.Guide →
• WordPress plugin. One-click wp_mail and WooCommerce deliverability test with SPF/DKIM/DMARC results. Guide →
• Team keys & environments.POST /v1/keys mints named keys scoped to live/test environments, withadmin/member roles.
• Bring your own domain.POST /v1/domains, add the TXT record, verify, and receive test mail on your own domain.

Access

InboxDome is free. There is nothing to buy. A key on its own gets you the free allowance below; connecting a free DevDome.com account lifts the limits and unlocks the private domain pool and BYO domains.

Monthly allowances reset on the 1st, UTC. Connect your DevDome account to lift the limits, or read the API Terms.