Email Inboxes
Disposable email addresses for end-to-end testing of email flows in your application
Email inboxes give your tests a real email address to receive messages. When your application sends a verification email, password reset, or notification, your test can read the email and act on its contents.
Permissions
All roles can view inboxes and read messages. Admins and owners can create and delete inboxes. See Roles and permissions.
Limits
| Limit | Value |
|---|---|
| Inboxes per organization | 5 |
| Messages per inbox | 1,000 |
| Message retention | 12 hours |
Messages older than 12 hours are removed automatically.
Create an Inbox
- Go to Operations → Email Inboxes in the sidebar.
- Click Create Inbox.
An inbox is created immediately with a randomly-assigned email address. The address is shown in the inbox list; click the copy icon next to it to copy it to the clipboard.
View Messages
Click any inbox row to open it. The message list shows the sender, subject, and received time.
Click the refresh button (top right of the message list) to reload messages. Click any row to open the message. If the message has an HTML body it is rendered in a sandboxed frame; otherwise the plain-text body is shown. Click the back arrow to return to the inbox list.
Delete an Inbox
Click the trash icon on any inbox row and confirm.
Deleting an inbox is permanent
All messages in the inbox are deleted along with it.
End-to-End Email Testing
To test an email flow in your application:
- Go to Operations → Email Inboxes and click Create Inbox. Copy the inbox address.
- Go to Operations → API Keys and create a key with at least Email inboxes: read. Copy the key value — you will not see it again. See API Keys.
- In your test, use the inbox address as the recipient email address for the step that triggers the email.
- Add an Email Validation step. Select the inbox in Inbox and the key in API Key, then write your checks in Code. When the step runs it fetches the inbox's messages with the API key and exposes them as a
messagesarray (id,fromAddress,subject,bodyText,bodyHtml,urls,receivedAt).
The API key is injected automatically at run time; you do not need to store it as an organization secret.