API v3 Overview NEW

API v3 is the new, consistent TempMail API. It adds account-level inbox management, a wait-for-email long poll, raw .eml downloads, per-inbox webhooks with automatic retries and delivery logs, custom domain management, a list of TempMail's own domains, scoped API keys, and a usage endpoint.

What changed from v2:

• Fetches consume exactly what they return. Emails you receive in a response are deleted; emails excluded by your filters (since, from, limit) stay in the inbox. v2 wipes the whole inbox on every read.
• Errors are consistent. Every error is { "error": { "code", "message" } } with a matching HTTP status-never a 200.
• Rate limits are visible. Responses carry x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset headers (reset is a unix timestamp in seconds). 429 responses include retry-after.
• v2 stays supported. Inboxes are shared between versions; v3 has its own create and fetch endpoints, but tokens work on both.

Scoped API Keys

Create additional API keys that can only do specific things, so your CI pipeline or a third-party integration never holds your full account credential. The key secret is returned once on creation and only a hash is stored.

Keys are managed with your primary API key (or the website), a scoped key can never manage keys.

Scopes

Create & Manage Inboxes

Create inboxes anonymously (free tier, per-IP limits) or with an API key (per-account limits, longer lifespans, account ownership). Inboxes created with a key belong to your account and can be listed with the inboxes:read scope; per-inbox endpoints are authorized by the inbox token itself.

POST /v3/inboxes - body (all optional)

GET /v3/inboxes - query

Fetch Emails & Raw .eml

Fetching emails consumes what it returns: emails in the response are deleted, while emails excluded by since or limit stay in the inbox (v2 deletes everything on read).

Raw RFC822 source is a TempMail Ultra feature. For Ultra-owned inboxes each fetched email includes a raw field with the exact MIME source received over SMTP (null if it was not captured). The standalone /raw endpoint downloads a .eml for an email that has NOT been consumed yet - useful with the email_id from webhook delivery logs. If the verbatim source is unavailable, a reconstructed .eml is served (marked with x-tempmail-reconstructed: true).

GET /v3/inboxes/:token/emails - query

Wait for Email (long poll)

Blocks until an email matching your filters arrives, or the timeout passes - one request instead of a polling loop. Perfect for signup flows and CI: request the OTP, then wait for it.

Matched emails are returned and consumed; emails that do not match the from/since filters stay in the inbox untouched.

Query

At most 2 concurrent /wait requests per inbox. A timeout is still HTTP 200, with "timed_out": true and an empty emails array.

Per-Inbox Webhooks & Delivery Logs

Attach a webhook to a single inbox (TempMail Ultra): new mail to that inbox is POSTed to your URL. Failed deliveries are retried automatically with backoff - 30s, 5m, 30m, 2h after the initial attempt (5 attempts total).

Every delivery and each attempt (status code, error, duration) is logged for 7 days and queryable - this covers account-wide (v2) webhooks, private domain webhooks, and per-inbox webhooks alike.

GET /v3/webhooks/deliveries - query

Custom Domains

Register a custom domain to your account, get the exact DNS records to create, and re-run verification whenever you like - with structured per-record results instead of a single pass/fail. Requires TempMail Plus or Ultra.

DNS records returned by the API

The exact TXT name/value pair is account-specific - always read it from the API response.

POST /v3/domains/verify re-checks up to 100 of your domains in one call, least recently checked first, and returns the same per-domain results. It can run once every 10 minutes per account; calling it sooner returns 429 rate_limited with a retry-after header.

TempMail Domains

List every domain TempMail itself serves, split into the premium pool that only Plus/Ultra accounts can create inboxes on and the free pool that any tier can use. Pass any of them as domain when creating an inbox. Requires TempMail Plus or Ultra and the domains:read scope; free accounts get a tier_required error.

Response fields

An entry starting with *. is a wildcard: both the bare domain and any subdomain of it are accepted, so *.example.com lets you create [email protected] or [email protected]. The lists change over time as domains are rotated in and out, so re-fetch them rather than caching them for long.

Usage & Quota

See your tier, how much of the inbox-creation window you have used, and counts of your active inboxes, keys, and domains. Requires the usage:read scope.