# PostInbox Mail

> PostInbox Mail (https://postinbox.org) is a temporary, receive-only e-mail service. Visitors get a free disposable address instantly, read incoming mail in the browser and copy detected verification codes (OTPs) with one click. Inboxes delete themselves automatically. A prepaid crypto wallet adds premium domains, longer retention, forwarding, Telegram and webhook alerts, and a developer REST API.

Key facts:

- Free inboxes need no account and are deleted automatically (24 hours by default).
- Addresses are receive-only; the service never sends mail from them.
- Verification codes (4–8 digits) and magic sign-in links are detected automatically.
- Links inside messages are masked through https://hidi.my/? to strip referrers.
- HTML mail is rendered in a sandboxed iframe with scripts, forms and event handlers removed.
- Attachments are checked against an allow-list and their sniffed file type; executables are always blocked.
- Premium domains are paid per created address (typically $0.05–$0.50), deducted from a wallet topped up with crypto via Cryptomus. The minimum top-up is $2.00.
- The REST API unlocks after the first top-up of at least $2.00. Until then, API endpoints return HTTP 403 with "First deposit of minimum $2.00 required to activate API access".

## Using the service

- [Temporary inbox](https://postinbox.org/): Generate an address, receive mail, copy OTP codes, download attachments or the original .eml.
- [Pricing and Pro features](https://postinbox.org/#pricing): Free inbox compared with the Pro wallet.
- [FAQ](https://postinbox.org/#faq): Lifespan, custom aliases, security, crypto top-ups, API automation, attachments.
- [Data breach checker](https://postinbox.org/tools/breach-check): Look up an e-mail address in Have I Been Pwned; check a password with k-anonymity (only 5 characters of the SHA-1 hash leave the browser).

## Developer API

- [API documentation](https://postinbox.org/docs/api): Full reference with examples.
- Base URL: https://postinbox.org/api/v1
- Authentication: `X-API-Key: pim_live_…` header (or `Authorization: Bearer …`).
- `POST /api/v1/inbox` with JSON `{"domain": "...", "alias": "..."}` creates an address. Without `domain`, a free domain is used. Paid domains are charged atomically; the response includes `billing` and the new `balance`.
- `GET /api/v1/messages?email=ADDRESS&since_id=N` lists messages with `otp_code` and masked `magic_link`.
- `GET /api/v1/message?id=ID` returns one message: text, sanitised HTML, OTP, attachments with signed download URLs.
- `GET /api/v1/domains`, `GET /api/v1/inboxes`, `GET /api/v1/me`, `DELETE /api/v1/inbox`, `DELETE /api/v1/message`.
- Errors: JSON `{"success": false, "error": {"code": "...", "message": "..."}}` with standard HTTP status codes (401, 402, 403, 404, 409, 422, 429).
- Rate limits are per account (token bucket) and reported in `X-RateLimit-*` headers.
- Webhooks: signed JSON POST per new message; header `X-PostInbox-Signature: sha256=HMAC_SHA256(secret, timestamp + "." + body)`.

## Optional

- [Blog](https://postinbox.org/blog): Guides on disposable e-mail, privacy and testing sign-up flows.
- [Privacy policy](https://postinbox.org/privacy)
- [Terms of service](https://postinbox.org/terms)