# Proxy Mail QA

> [Proxy Mail QA](https://proxymail.qa) gives QA testers and developers private, disposable, time-bound email addresses for testing sign-up, email verification, OTP, magic-link, password-reset and invite flows. When an email arrives, its verification code or link is extracted and shown ready to copy or click.

## What it does

- Create a random address on mailclub.dev (or the alternate domains enable.li and valida.te.it, for apps that block one) in one click, or choose a custom name. Plus-addressing (name+tag@) is supported.
- Addresses last 1 to 30 days on the Free plan. After expiry, mail is rejected, the address and its mail are deleted within an hour, and the name is never reissued.
- Each email's primary action is extracted: OTP or verification codes (with a countdown), or a verify, sign-in, invite or password-reset link. The full email is available in a sandboxed inbox view with remote images blocked by default.
- Works with emails from Supabase Auth, Firebase Authentication, Clerk, Auth0, Amazon Cognito and most apps that send transactional email, as long as the app's email provider can send to any address. Providers in sandbox or test mode (Amazon SES before production access, Resend without a verified domain, Mailgun sandbox domains, Postmark before approval, Supabase's built-in email) only send to verified addresses, so no test inbox can receive their mail.
- Generated test personas (first name, last name, username, and a date of birth for an age band: adult, 21+, under 18, under 15, under 13, any age, turning 18 tomorrow or today; and a country, as an ISO code such as GB), notes, tags and encrypted saved test passwords per address.
- Projects to group addresses by client or app. New mail appears live.
- Reports per project: a Dashboard by period and test area (failed email checks, mail refused or turned away and failed runs; changes such as a new sending provider, a code where there was a link or links to a different site; where emails would land; how fast emails arrive; how many codes and links were used, replaced or expired first) and a QA report for a period or a run (a verdict, what failed, what was tested, the runs, and every email's type, checks and code or link, with links shown without their tokens), narrowed by area, tag, run or only addresses with problems, with the tester's summary and the organisation's logo, printed, as PDF or CSV; saved passwords only when chosen. QA reports flag addresses that share a saved password, without revealing it.
- Each code or link shows when it was used and by whom (opened, copied or filled in the app or Proxy Mail QA for Chrome, or fetched by an agent or test), and an older one shows when a newer email of the same kind replaced it.
- Runs: a CI job or agent session's evidence (addresses, which emails arrived and how fast, codes, link sites, checks, unsubscribe, offer and coupon checks, failed tests, missing emails), compared with the runs before it, with a Markdown report; the GitHub Action (aaquib90/proxymail-qa-action) posts it on the pull request, and a run's page prints it as a QA report. Kept 90 days.
- An account pool: tests check out an account in a known state (by tags, country, age or saved password) that no other test has, and return it, recording its new state.
- Debug mode per project keeps each email's original .eml file, downloadable from the inbox, until the address expires.
- An activity log of who created, used, revealed and deleted what, and how (the app, the Chrome extension, an agent or an API key), with a filter, for owners and admins.
- Receive-only: test inboxes never send, reply to or forward mail. Every inbox belongs to a signed-in account and is private to it.
- Data is stored in the United States (Supabase, AWS us-east-2). It's meant for test accounts only: no personal email, real personal data or real passwords.

## Feature pages

- [Inbox dashboard](https://proxymail.qa/features/dashboard): the Accounts view, row by row, what each test account keeps, filters, search and the safe inbox view, with an interactive demo
- [Projects and teams](https://proxymail.qa/features/projects): what a project holds, setting one up, how API keys and agents reach one project, Team plan roles, organisation and project logos and profile pictures, address limits by plan, reports, runs, the account pool, activity log and debug mode
- [Tests and CI](https://proxymail.qa/features/tests): the npm package, the Python helper and the REST API in end-to-end tests, the GitHub Action's report on the pull request, the account pool for parallel tests and the email checks
- [AI agents](https://proxymail.qa/features/agents): how coding agents sign up and get the code themselves, what they can do, and why they need no database keys
- [Marketing and offers](https://proxymail.qa/features/marketing): coupons and how fast they arrive, checkout results, offer reuse through address versions, unsubscribe watches, consent and marketing rules by country, marketing email checks, welcome series timing, harmful attachments and spam risk
- [Deliverability](https://proxymail.qa/features/deliverability): the spam score out of 10 and its markers, harmful attachments, mail Cloudflare's mail servers turned away, SPF, DKIM and DMARC, size and layout checks, and the counts in Reports and run reports
- [Chrome extension](https://proxymail.qa/chrome-extension): fills sign-up forms and shows the code or link in the page; in Labs, Offers and Marketing modes for coupons, the marketing box and unsubscribing
- [MCP server and plugins](https://proxymail.qa/features/mcp): connecting each client, the tools, browser sign-in and security, the Claude Code plugin, the Cursor Directory listing (https://cursor.directory/plugins/proxymail-qa), the ChatGPT plugin directory listing (https://chatgpt.com/plugins/plugin_asdk_app_6acde757c5748191af402b25494ad875), the Qoder Marketplace connector (https://qoder.com/en/marketplace/connector?id=proxymail-qa) and plugin (https://qoder.com/en/marketplace/plugin?id=3b572e73-56f2-47d6-add5-df0109705fb3), the agent skill and the MCP Registry listing

## Plans

- Free: the whole product for individuals, with 500 addresses in total (up to 50 a day), around 500 incoming emails a day under fair use, and 5 MB per message.
- Team ($5 a month or $45 a year per organisation, or $95 once for Lifetime; plus tax where it applies): unlimited addresses (also in the owner's and admins' own spaces), an organisation with unlimited seats, per-project access (admins see every project), invites and member requests, and a shared activity log. Receiving on your own domain is planned for later.

## API and MCP server (agents and tests)

- [Developer docs](https://proxymail.qa/docs) (every page has a Markdown copy: add .md, or send Accept: text/markdown)
  - [API and MCP server, with the one-prompt agent setup](https://proxymail.qa/docs/api)
  - [MCP server for each client (Claude Code, Cursor, GitHub Copilot, Antigravity, Codex, Windsurf, Zed, Kiro, Amazon Q Developer, OpenCode, Kilo Code, Roo Code, Augment Code, Trae, Mistral Vibe, Qwen Code, Kimi CLI, JetBrains IDEs, Claude and ChatGPT) and its tools](https://proxymail.qa/docs/mcp)
  - [REST API](https://proxymail.qa/docs/rest-api): waiting, counting emails and checking that none arrive, email checks, runs, the account pool, dates of birth, errors
  - [REST API reference, generated from the OpenAPI description](https://proxymail.qa/docs/reference)
  - [Node client on npm: proxymail-qa](https://proxymail.qa/docs/node): npm install --save-dev proxymail-qa; ProxyMailQA with createAddress, waitForCode, waitForLink, messages, checkDelivery, variants, nameVariants, passwordVariants, setPassword ([npm](https://www.npmjs.com/package/proxymail-qa))
  - [Playwright](https://proxymail.qa/docs/playwright)
  - [Cypress](https://proxymail.qa/docs/cypress)
  - [Puppeteer](https://proxymail.qa/docs/puppeteer)
  - [Python](https://proxymail.qa/docs/python): pytest with Selenium or Playwright for Python; a standard-library helper
  - [Running in CI](https://proxymail.qa/docs/ci): API key as a secret, one address per run with plus-tags, parallel workers, Claude Code GitHub Action, Copilot coding agent, Codex
  - [API keys](https://proxymail.qa/docs/api-keys)
  - [Mobile apps](https://proxymail.qa/docs/mobile): Maestro, XCUITest, Espresso, Flutter, Detox and Appium helpers that create addresses, wait for codes and links, check and count emails, sign in as saved accounts or borrow pooled ones, and join CI run reports; opening links on simulators and emulators
  - [iOS apps with a coding agent](https://proxymail.qa/docs/ios-agents): Claude Code Desktop's iOS Simulator pane, Xcode's tools through xcrun mcpbridge, Xcode's own agents
  - [Android apps with a coding agent](https://proxymail.qa/docs/android-agents): Claude Code, Codex or Cursor with adb, and Android Studio's Gemini agent
  - [Unusual email addresses](https://proxymail.qa/docs/unusual-addresses): variants that still reach the inbox: capitals, plus tags with special characters, 64-character names; and invalid ones for testing rejection
  - [Unusual names and passwords](https://proxymail.qa/docs/unusual-names-and-passwords): names with apostrophes, accents and other scripts, very long ones, HTML or SQL to store as text; passwords at a field's limits, each symbol class, spaces, non-ASCII, bcrypt's 72 bytes
  - [Limits and safety](https://proxymail.qa/docs/limits)
  - [Labs](https://proxymail.qa/docs/labs): features a person switches on in **Account settings → Labs** before they're available to everyone. Now: Marketing and offer emails (the Offers and Marketing areas, record_coupon_result, check_offers, mark_unsubscribed, mark_resubscribed, check_unsubscribe, record_consent, check_sequence and the coupon and marketing checks), and Spam score and attachment checks (spam_risk, harmful_attachment). API keys and agents follow their creator's switches; while off, those tools answer 403 forbidden and check_email leaves the checks out
- [REST API](https://api.proxymail.qa/v1) ([OpenAPI](https://api.proxymail.qa/v1/openapi.json)). Create an address, then GET /v1/addresses/{address}/code or /link waits up to 30 seconds and returns just the code or link, its kind, the sending service and expiry. When nothing arrives, the 404 (and the MCP tools' found: false answer) adds a hint: mail we refused for the address and why, or that nothing has reached it. GET /v1/addresses finds test accounts made earlier by tag, country, age (min_age, max_age), saved password or text (search). GET /v1/addresses/{address}/delivery checks an address at any time without waiting. GET /v1/addresses/{address}/variants lists unusual versions for testing sign-up forms; variants (capitals, +tags) work wherever the API takes an address. GET /v1/variants/names and /v1/variants/passwords give awkward names and passwords for the form's other fields, grouped by what the app should do with each. GET /v1/addresses/{address}/count counts the emails that arrived since a time, and /none checks that none arrive (200 if nothing came within the timeout, 409 as soon as one does), each email summarised by time, sender and code or link kind, never its content. GET /v1/addresses/{address}/checks checks an email that arrived: SPF, DKIM and DMARC, links to localhost or plain http, where its link goes (expect_host), a stated expiry, a plain-text part, size and image-only emails; pass, fail, warn or skip per check, verdicts only. Waits take unused=true to skip a code or link already used. POST /v1/runs starts a run: calls with its id in the Proxy-Mail-QA-Run header add what they saw, and GET /v1/runs/{id}?format=markdown is the report for a pull request. POST /v1/addresses/checkout checks out an account matching filters that no other test holds; /extend and /return (with its token, and tags to record its new state) follow.
- [MCP server](https://api.proxymail.qa/mcp) (Streamable HTTP; signs in by browser, or an API key as bearer). Tools: get_project, create_address (an address with a persona, a date of birth for an age and a country if asked, a password for the sign-up form if asked, and the site and environment it's used on), form_values (what to type or pick in each field of a sign-up form, from what the page says about each), wait_for_code (kind: coupon for a coupon or promo code, with its discount and valid-until date), wait_for_link (app: true for the link that opens a mobile app; kind: unsubscribe for an unsubscribe link, never opened), list_addresses (filters find a test account made earlier by tags, country, age, saved password, text, site or environment), get_saved_password and get_sign_in (a saved password, or a saved test account for a site and its password in one call; keys allowed to read passwords only), mark_dev_host (links to a dev host such as localhost:3000 pass the email checks), update_project (the project's name, website, environments, email prefix or default mail domain, for its lead or an organisation owner or admin), update_address (name, username, date of birth, country, notes, tags, label), set_password (save the password the test account uses now, after the app changed or reset it), check_delivery (what reached an address, what we refused and why), get_address_variants (unusual versions of an address for testing sign-up forms), get_name_variants and get_password_variants (awkward names and passwords for the form's other fields: apostrophes, accents, other scripts, each symbol class, the field's limits, HTML or SQL to store as text), delete_address, check_email (SPF, DKIM, DMARC, local or http links, where links go, a stated expiry, size, how soon it came after since, expected attachments, harmful attachments, and spam_risk, a spam score out of 10 with its markers: verdicts only), and category (auth, transactional or marketing) on count_emails, expect_no_email and check_email, count_emails, expect_no_email (until for up to an hour), mark_unsubscribed, mark_resubscribed and check_unsubscribe (an unsubscribe watch: marketing email after unsubscribing fails), check_offers (an offer given to more than one version of an address), check_sequence (a welcome series or drip campaign, in order and on time), record_coupon_result (what checkout did with a coupon), record_consent (what an account agreed to, for the marketing rules by country), check_out_account, extend_checkout and return_account (an account pool for parallel tests), start_run, add_run_note and finish_run (a session as a run, with a Markdown report). Waits take unused: true. Every tool accepts a variant (capitals, a +tag) wherever it takes an address. The tool list fits the project: the coupon tools are listed when it tests Offers, the unsubscribe, consent and sequence tools when it tests Marketing (**Project settings → What you test**), and both while Marketing and offer emails is on in Labs or once it's available to everyone. Prompts: test_signup_flow, test_password_reset, test_sign_in_code, prepare_account, auth_regression_pack, audit_auth_emails, audit_marketing_emails, test_unsubscribe, test_offer_reuse, test_coupon_checkout, audit_marketing_consent.
- [Setup to paste into Claude Code, Cursor, GitHub Copilot or another agent](https://proxymail.qa/docs/api#agent-setup)
- Docs search for agents without an account: the MCP server https://search.proxymail.qa/mcp (one tool, search), or POST https://search.proxymail.qa/search with {"query": "…"}. Signed-in MCP connections have it as search_docs. People can ask questions at https://proxymail.qa/ask
- [How agents get access (auth.md)](https://proxymail.qa/auth.md): register with the person's email (auth.md service_auth: they sign in and type a 6-digit code the agent shows them), the MCP server's OAuth sign-in by browser, or an API key; no anonymous registration
- WebMCP: in browsers that support it, every page of proxymail.qa offers the read-only tools search_docs, read_page (any page as Markdown) and get_agent_setup
- [Proxy Mail QA for Chrome](https://proxymail.qa/chrome-extension): free on every plan ([Chrome Web Store](https://chromewebstore.google.com/detail/proxy-mail-qa-for-chrome/pjfkhpfocjfhlddallkabnoobadikbad)). A browser extension for testing sign-ups by hand. On test sites the tester turns it on for, one click fills a test address, name, username, date of birth and password into the sign-up form; after submitting it asks to save the password to the address; the code or link appears in the page with Fill, Copy or Open.
- Sign-in: an API key created by a signed-in person in **Project settings → API keys**, or OAuth (claude.ai, ChatGPT and other MCP clients sign in by browser and the person chooses a project). Available on the Free plan (60 requests a minute per key).
- What people ask: "Give me a test email for my staging sign-up and tell me the code when it arrives" (create_address, then wait_for_code; in a chat the person signs up with the address), "Why isn't my app's verification email arriving?" (check_delivery), "Check the password-reset email my app sent to my test address" (check_email), and, for agents that can use a browser, "Sign up on localhost:3000 with a new test account and confirm the email".
- [Agent skills](https://proxymail.qa/skills): every skill we publish, for Claude Code, Cursor, Codex, GitHub Copilot, Qoder and other agents that read skills, each with its install command, file and ZIP. `npx skills add https://proxymail.qa` installs them from the site's index ([/.well-known/agent-skills/index.json](https://proxymail.qa/.well-known/agent-skills/index.json))
- [Agent skill](https://proxymail.qa/.well-known/agent-skills/proxymail-qa/SKILL.md)
- [Auth regression pack skill](https://proxymail.qa/.well-known/agent-skills/auth-regression-pack/SKILL.md): the same checks of sign-up, reset and invitation emails and links every time, including link reuse, with a report of what changed since the last run
- [Marketing email testing skill](https://proxymail.qa/.well-known/agent-skills/marketing-email-testing/SKILL.md) (needs Marketing and offer emails switched on in Labs): welcome coupons and checkout, one offer per person, unsubscribing that sticks, consent rules by country, welcome series timing and spam risk, on staging with test payments only

## Getting started

- [Security: how data and passwords are protected end to end](https://proxymail.qa/security): test accounts only, AES-256-GCM for saved test passwords, row-level security, retention, what isn't built yet
- [How to use Proxy Mail QA, step by step](https://proxymail.qa/getting-started): create an account, create a test address, use it, copy the code or click the link, read the full email, saved passwords and personas, clean-up
- [Test email not arriving? Usual causes, email providers in sandbox or test mode and their fixes, and what we refuse](https://proxymail.qa/troubleshooting) (send Accept: text/markdown, or add .md, for a Markdown copy)

## Guides: what we solve

- [Test sign-up and email verification](https://proxymail.qa/solve/email-verification-testing)
- [Test OTP and one-time login codes](https://proxymail.qa/solve/otp-code-testing)
- [Test magic links and passwordless sign-in](https://proxymail.qa/solve/magic-link-testing)
- [Test password reset emails](https://proxymail.qa/solve/password-reset-testing)
- [Stop sharing one Gmail inbox for QA](https://proxymail.qa/solve/shared-test-inbox)
- [Take QA notes on each test account by voice with Wispr Flow](https://proxymail.qa/solve/voice-notes-wispr-flow)
- [Verification link points to localhost:3000](https://proxymail.qa/solve/localhost-links): fixes for Supabase, Lovable, Firebase, Auth.js, Rails, Django, Laravel
- [Common Supabase sign-up and login problems](https://proxymail.qa/solve/supabase-auth-problems): missing emails, rate limits, expired and scanned links, PKCE in another browser, Database error saving new user
- [Common Firebase sign-up and login problems](https://proxymail.qa/solve/firebase-auth-problems): no verification email, enumeration protection, emailVerified not updating, unauthorized-continue-uri, email-link sign-in, sign-up limits, emulator
- [Sign-up and login problems in vibe-coded apps](https://proxymail.qa/solve/vibe-coded-login-problems): Lovable, Bolt, v0, Replit, Base44, Cursor, Claude Code: works only for you, preview links, missing callback and reset pages, swallowed errors
- [Test sign-up emails in Playwright](https://proxymail.qa/solve/playwright-email-tests)
- [Test sign-up emails in Cypress](https://proxymail.qa/solve/cypress-email-tests)
- [Test sign-up emails with pytest](https://proxymail.qa/solve/pytest-email-tests)
- [Test coupon codes and welcome offers](https://proxymail.qa/solve/coupon-code-testing)
- [Test unsubscribe links and one-click unsubscribe](https://proxymail.qa/solve/unsubscribe-testing)
- [Test that a welcome offer can't be claimed twice](https://proxymail.qa/solve/welcome-offer-abuse)

## Guides: use cases (scenarios that need many test accounts, on apps you build or are allowed to test)

- [Age gates and age-restricted content](https://proxymail.qa/use-cases/age-restricted-content): one account per age band, parental consent emails
- [Content that depends on location](https://proxymail.qa/use-cases/location-based-content): geo-blocking, regional prices, tax, consent
- [Predictor game and fantasy league scoring](https://proxymail.qa/use-cases/predictor-games): a player per scoring rule, tie-breaks, results emails
- [Membership tiers, paywalls and free trials](https://proxymail.qa/use-cases/membership-tiers)
- [Roles and permissions, including across customers](https://proxymail.qa/use-cases/roles-and-permissions)
- [Ticket ballots and prize draws](https://proxymail.qa/use-cases/ballots-and-prize-draws)
- [Referral rewards and welcome offers, including abuse rules](https://proxymail.qa/use-cases/referrals-and-welcome-offers)
- [Both sides of a marketplace](https://proxymail.qa/use-cases/marketplaces)
- [Email changes, lockouts and account deletion](https://proxymail.qa/use-cases/account-changes)
- [Email preferences, consent and unsubscribe](https://proxymail.qa/use-cases/email-preferences)
- [Marketing email rules by country (EU, UK, US, Canada, Australia, New Zealand, Switzerland, Japan, South Korea, Singapore, Hong Kong)](https://proxymail.qa/use-cases/marketing-rules-by-country)
- [Welcome series and drip campaigns: order and timing](https://proxymail.qa/use-cases/drip-and-welcome-series)

## Guides: mobile apps

- [Sign-up emails in an iOS app (SwiftUI or UIKit): codes and Universal Links in the simulator and XCUITest, cold-start links](https://proxymail.qa/mobile/ios-sign-up-testing)
- [Sign-up emails in an Android app (Kotlin): codes and App Links on the emulator and in Espresso, links that open Chrome instead](https://proxymail.qa/mobile/android-sign-up-testing)
- [Sign-up emails and magic links in React Native and Expo](https://proxymail.qa/mobile/react-native-expo): exp:// and myapp:// links, Detox with the npm client
- [Sign-up emails in a Flutter app](https://proxymail.qa/mobile/flutter): integration tests, deep links on both platforms, Supabase redirects
- [Firebase email-link sign-in on iOS and Android after Dynamic Links shut down](https://proxymail.qa/mobile/firebase-email-link): Hosting domain, Associated Domains, App Links

## Guides: apps built with AI tools

- [Lovable](https://proxymail.qa/built-with/lovable)
- [Replit](https://proxymail.qa/built-with/replit)
- [Bolt](https://proxymail.qa/built-with/bolt)
- [Base44](https://proxymail.qa/built-with/base44)
- [v0](https://proxymail.qa/built-with/v0): Supabase or Clerk login on Vercel deployments
- [Claude Code](https://proxymail.qa/built-with/claude-code)
- [OpenAI Codex](https://proxymail.qa/built-with/codex)
- [Qoder](https://proxymail.qa/built-with/qoder)
- [Cursor](https://proxymail.qa/built-with/cursor)
- [Google Antigravity](https://proxymail.qa/built-with/antigravity): Firebase Authentication, unverified users, authorized domains
- [Login methods explained](https://proxymail.qa/built-with/login-methods): email and password, codes, magic links, Google and Apple buttons, phone and SSO, what each sends and how to test it

## Guides: auth providers (the emails Supabase, Clerk, Auth0, Firebase, Auth.js, Better Auth and Amazon Cognito send, and their sending limits)

- [Supabase Auth](https://proxymail.qa/auth/supabase)
- [Clerk](https://proxymail.qa/auth/clerk)
- [Auth0](https://proxymail.qa/auth/auth0)
- [Firebase Authentication](https://proxymail.qa/auth/firebase)
- [Auth.js (NextAuth)](https://proxymail.qa/auth/authjs)
- [Better Auth](https://proxymail.qa/auth/better-auth)
- [Amazon Cognito](https://proxymail.qa/auth/cognito)

## Comparisons

- [All tools at a glance](https://proxymail.qa/compare)
- [Proxy Mail QA vs Mailinator](https://proxymail.qa/compare/mailinator)
- [Proxy Mail QA vs Mailtrap](https://proxymail.qa/compare/mailtrap)
- [Proxy Mail QA vs Mailosaur](https://proxymail.qa/compare/mailosaur)
- [Proxy Mail QA vs MailSlurp](https://proxymail.qa/compare/mailslurp)
- [Proxy Mail QA vs testmail.app](https://proxymail.qa/compare/testmail)
- [Proxy Mail QA vs Mailpit and MailHog](https://proxymail.qa/compare/mailpit)
- [Proxy Mail QA vs Ethereal Email](https://proxymail.qa/compare/ethereal)
- [Gmail plus-addressing vs test inboxes](https://proxymail.qa/compare/gmail-plus-addressing)

Proxy Mail QA is built for testing email flows by hand and for coding agents (MCP server and REST API, on the Free plan), with real addresses that receive email from any app or hosted auth service (Supabase, Clerk, Auth0, Firebase). For SMS, sending, email previews or client libraries, Mailosaur, MailSlurp, Mailinator or testmail.app fit better. For catching your own app's email in development without delivering it, Mailtrap's Email Sandbox or Mailpit fit better.

Links in test emails that point to localhost or another local address (directly or after a redirect) are flagged in the app; testers can mark a host as a dev environment per project.

## Links

- [Sign up](https://app.proxymail.qa/?mode=signup)
- [Sign in](https://app.proxymail.qa/)
- [Report abuse](https://proxymail.qa/abuse)
- [Service status](https://proxymailqa.statuspage.io): incidents and maintenance: process and contact
- [Every page in one file](https://proxymail.qa/llms-full.txt): the full text of the home page, feature pages, guides, comparisons and developer docs, for assistants that read one file
- [Changelog](https://proxymail.qa/changelog): what changed in the app, API, MCP server, npm package, Chrome extension and marketplace listings, newest first ([RSS](https://proxymail.qa/changelog.xml))