Test the email step,
without a shared mailbox.
Every signup, invite, password reset and OTP ends in an email — and almost every test suite fakes it. Allocate a throwaway address, send real mail to it, and read the code back over an API. No mailbox to share, no IMAP poller to maintain.
Four steps, and none of them is a mailbox.
An address exists for as long as your test does. Mail sent to it is parsed, sanitised and readable within seconds — by a person watching the dashboard, or by the CI job that triggered it.
Allocate an address
One call returns a fresh address on our domain and a short phrase to go with it. The local part is 60 bits of randomness, so it cannot be guessed or enumerated — and it is never reissued to anyone, ever.
Point your test at it
Use it as the signup address in your fixture, and include the phrase anywhere in the subject your app sends. Your own application is the one thing in this loop you control, so it costs a line in a template — and it is what makes the address useless to anybody else.
Read it back
Poll the messages endpoint, or watch the dashboard. Ask for the one-time code with a query parameter and skip the regex you would otherwise hand-roll.
Let it expire
Messages are deleted at the end of the retention window, and on the free tier the address itself expires after 24 hours. Release it sooner the moment a run finishes. Nothing accumulates.
This service never sends mail. There is no submission path, unknown recipients are refused at RCPT TO so the sending server raises any bounce, and the inbox domain publishes v=spf1 -all.
The parts you would otherwise build badly.
A shared Gmail account with an app password is the usual answer. It works until two suites run at once, the password rotates, or someone has to explain it in an audit.
One-time codes, extracted
Ask for extract=otp and get the code and the links back as fields. The heuristic returns nothing rather than guessing — a confident wrong code fails your suite against the wrong system.
SPF, DKIM and DMARC verdicts
Every message shows how it authenticated. It is the fastest way to find out why your own sender is landing in spam, and no throwaway-mail site offers it.
Addresses that are never reused
A released address is tombstoned permanently. Recycling one hands its next holder the password-reset mail for whatever account the previous holder signed up with.
A domain that stays deliverable
On the free tiers a message is only accepted if its subject carries the phrase issued with the address. That means these addresses cannot be used to sign up to other people’s services — which is exactly why the large providers have no reason to blocklist this domain, and why the address you test with today still works next quarter. Paid plans make it optional, for suites that receive mail they do not control.
HTML rendered safely
Bodies are sanitised on the way in with an allow-list, then rendered in a sandboxed frame under a content-security policy. Remote images stay blocked until you ask, so a tracking pixel does not fire on open.
Attachments named, not served
You see the filename, type, size and SHA-256 of everything attached. The bytes are deliberately not stored — a service anyone can mail should not also be a download host.
Isolated per workspace
Every address, message and key is scoped to your workspace and enforced on every route. A message that is not yours answers 404, not 403, so ids cannot be probed.
The whole product, in one request.
This is the call a signup test makes after it submits the form. No IMAP, no polling library, no regex for the code.
curl -s \ -H "Authorization: Bearer $INBOXES_TOKEN" \ "https://inboxes.nimbusnexus.net/v1/inboxes/$INBOX_ID/messages?extract=otp&since=$STARTED_AT"
{
"items": [{
"from_addr": "[email protected]",
"subject": "Confirm your address [nn-7f3a2b]",
"auth": { "spf": "pass", "dkim": "pass", "dmarc": "pass" },
"extracted": { "otp": "418902", "links": ["https://your-app.test/verify?t=..."] }
}],
"next_offset": null
}Free to look, paid to automate.
The dashboard reads on every plan, including free — what a paid plan buys is the ability to automate against it, keep mail longer, hold more than one address at a time, and receive mail from senders you do not control.
Free
For the occasional run
$0
- One address, replaced every 24 hours
- Subject must carry your phrase
- 24-hour message retention
- 1,000 messages a month
- Dashboard reading, no API
Starter
Early accessFor a suite that runs in CI
$19/ month
- Five addresses
- 7-day retention
- 25,000 messages a month
- Messages API and code extraction
Pro
Early accessFor a team of suites
$99/ month
- Twenty-five addresses
- 30-day retention
- 250,000 messages a month
- Attachment storage retained
Custom
For an organisation
Contact sales
- Address count and retention to contract
- Your own inbox domain
- Phrase optional on every address
- Volume, SLA and support agreed directly
The metered unit is an accepted message. A message refused at the door — unknown address, no phrase in the subject, over quota, past the size cap — is never stored and never counted. Larger volumes and longer retention are arranged directly.
- Unguessable, never-reused addresses
- Allow-list HTML sanitising
- SPF / DKIM / DMARC verdicts
- Sandboxed message rendering
- Per-workspace isolation
- Audit log of every change
- Attachment metadata and digests
- No outbound mail, ever
Paid plans are not self-serve yet: billing for this product is still being wired, so a plan change is arranged with us directly. The free tier needs no such conversation.
Before you point a test at it.
Stop testing around the email step.
Tell us what your suite needs and we will get you an address. Larger volumes, longer retention and a custom domain are all arranged directly while self-serve billing is being finished.