Questions, answered

BlinkInbox is a disposable email service. Open the site and you get a working inbox instantly, with no signup. Developers can also create inboxes through a REST API or an MCP server, which is useful for automated tests and AI agents.

Yes. The browser inbox is free with no account, up to 3 inboxes in any 24 hours. A free Developer account adds API and MCP access, also with 3 inboxes in any 24 hours. Pro raises that to 10, and Scale is unlimited.

You can pick the start of it: a prefix such as "signup" gives you signup followed by 8 random characters. Pro and Scale can choose an exact address, and with a custom domain you can use any address on your own domain.

No. Anyone who knows an address can send mail to it, but only the browser, API key or connected app that created the inbox can read it. Addresses also end in 8 random characters, and an address on our shared domain is never given to another account, even after it expires.

No. The browser inbox is remembered in that browser until it expires, so you can come back to it. It is not available from other browsers or devices.

Browser inboxes last 30 minutes. API inboxes last as long as you ask for, up to 60 minutes on the free plan, 7 days on Pro and 30 days on Scale. Mail is deleted automatically 24 hours after the inbox expires.

No. Inboxes are receive-only. That keeps the service from being used for spam.

Some sites block known disposable email domains. On Pro and Scale you can receive mail on your own domain, such as anything@test.yourcompany.com, which those sites treat like any other address.

Yes. Temp mail, burner email, throwaway email and 10 minute mail all describe the same idea: a short-lived address that keeps your real inbox private.

Yes. Every incoming message is scanned for one-time codes (for example "482913" or "G-4F7K2Q") and for verification or magic-link URLs. They appear as one-click chips in the inbox and as otp / verificationLink fields in the API.

The full message is always available. In the API, the codes field lists the top five candidates, best first, and the raw text and HTML are returned too.

Call GET /v1/inboxes/{inbox}/messages/wait or /otp with a timeout. The request returns as soon as a matching message arrives (up to 60 seconds), so you need no sleep() calls and no polling loop.

The Model Context Protocol server lets AI agents such as Claude, Cursor or VS Code Copilot create inboxes, wait for emails and read codes as tools. Add https://api.blinkinbox.club/api/mcp as a remote server and sign in when your client asks: it uses OAuth, so no key is copied anywhere, and you can grant read-only access. Clients without OAuth can send an API key instead.

Yes, on Pro and Scale. Add the domain in the dashboard, publish one MX and one TXT record, and click verify. You can then create inboxes such as anything@test.yourcompany.com.

Open the dashboard and go to Connected apps. Revoking an app invalidates its tokens immediately; it has to ask for your consent again to reconnect.

Each delivery carries a BlinkInbox-Signature header: an HMAC-SHA256 of the timestamp and raw body using your webhook secret. Reject deliveries older than 5 minutes. Failed deliveries are retried 3 times (after 2 seconds, 10 seconds and 1 minute), and a webhook is turned off after 25 failures in a row.

Requests are limited per API key: 60 a minute on the free Developer plan, 600 on Pro and 3,000 on Scale. Responses include RateLimit headers, and you get a 429 status with the code quota_exceeded or a rate-limit error when you go over. Wait and retry.

An email address that an AI agent creates and reads by itself. BlinkInbox exposes inboxes as MCP tools and a REST API, so an agent can make an address, use it in a sign-up form, wait for the email and read the code or link without you copying it over. See blinkinbox.club/ai-agents.

Yes. When you connect an app over OAuth you can grant read-only access, which lets it read mail but not create or delete inboxes. Every connected app is listed in your dashboard and can be revoked at any time.

Use the Talk to us button on the pricing page or the contact form. We set up the plan on your account and agree payment with you. Self-serve checkout is coming.

Inboxes and mail are deleted automatically 24 hours after each inbox expires. To delete your developer account, API keys and settings, send a request through the contact form from your account email.

No. Messages are processed automatically to extract codes and links, shown only to the browser, API key or connected app that owns the inbox, and deleted 24 hours after the inbox expires.

HTML is rendered in a sandboxed frame with scripts disabled, so a malicious email cannot run code on this site or read your session.

Dangerous file types (executables, scripts, installers, disk images, macro-enabled Office files, HTML and SVG) are never stored. We check the extension, the declared type and the file contents, so a renamed .exe is still blocked. Files over 10 MB, or beyond 12 MB in total per message, are not stored either. Other files download without being opened in the browser. Archives such as .zip are not scanned inside, so open them only if you expected them.

Only for your own developer account: a code to confirm your email address when you sign up, a code each time you sign in (two-step sign-in), and a password reset link when you ask for one. BlinkInbox never forwards mail and never sends mail from your inboxes.