Testing auth emails in apps you build with Claude Code

Where email fits in a Claude Code workflow

Claude Code is Anthropic’s coding agent. It works in your terminal, your editor and the browser, reads your codebase and makes changes across it. Ask for “email and password sign-up with verification” and you’ll get the forms, the API calls and the templates, wired to whatever you use: Supabase Auth, Clerk, Auth.js, Firebase or your own backend.

What it can’t easily do is receive the email. Unit tests mock the sender, and end-to-end tests often skip verification. So the first real confirmation email is frequently sent to the first real user.

A five-minute end-to-end check

1. Create an address in Proxy Mail QA. Make a few at once if you want one per scenario, such as new user, invited user and reset.
2. Run your app (npm run dev or similar) and sign up with the address.
3. Watch the code or link arrive. It shows up on the address’s row within seconds, with a Copy button for a code or an Activate account button for a link.
4. Finish the flow. Paste the code into your app, or click the link. If the link points at localhost:3000 we flag it. That’s expected while you develop locally: choose This is my dev environment and it won’t be flagged again in that project.
5. Repeat on staging before you ship. Now a localhost link is a real bug, and the most common one in generated auth code. Here’s how to fix it.

Hand Claude Code the evidence

When something is off, paste what you saw straight into your session. Specific beats vague:

• “The confirmation email on staging links to http://localhost:3000/auth/confirm. Build the redirect URL from an environment variable and set it per environment.”
• “The reset email says the link lasts 60 minutes, but it stops working after 5. Find where the expiry is set.”
• “Two verification emails arrive for one sign-up. Find the duplicate send.”

The inbox view shows each email’s sender, subject, full content and every link found in it, which is usually all the agent needs.

Tips

• Tag your runs. Mail to k3f9q2m8x7aa+run2@mailclub.dev arrives in the same inbox with the tag run2 shown, so repeated runs stay distinguishable.
• Keep the password with the account. Save the password you signed up with on the address, or use Generate password for one that passes common rules.
• Group by project. One project per app you’re building, with its staging URL linked and an optional prefix so its addresses are easy to spot.