Quick setup checklist

Open your dashboard API Management page and create your personal API key.
Copy the exact User API Base URL shown there, for example https://v1.tempmailg.com/api.
Send every request to that API host with Authorization: Bearer YOUR_USER_API_KEY and Accept: application/json.
Track your monthly request quota from the same dashboard page and from quota headers when available on user API responses. Only successful 2xx requests count toward the quota.

If the API returns 404 Make sure you are calling the dedicated User API host exactly as shown in your API Management page.

API key access

Authentication flow

Generate your personal API key from the dashboard API Management page.
Send the key as a Bearer token in every request.
Use the dedicated User API Base URL shown on your API Management page.
Regenerate the key any time you want to invalidate the old one and start using a new key immediately.

Key visibility Your user API key stays visible inside your API Management page until you regenerate or revoke it.

Required headers

Authorization: Bearer YOUR_USER_API_KEY
Accept: application/json

Rate Limit & Quota Headers

Rate-limit headers describe the indicated request budget. Quota headers are included when quota information is available; minute-limit rejections do not calculate your full monthly quota.

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1729520000
X-Quota-Limit: 50000
X-Quota-Remaining: 48210
X-Quota-Used: 1790
X-Quota-Reset: 2026-11-01T00:00:00+00:00
X-RateLimit-Scope: account
Retry-After: 42 (when a timed retry is available)

X-RateLimit-Limit — Maximum requests allowed per minute (RPM) for your plan.
X-RateLimit-Remaining — RPM requests remaining in the current minute window.
X-RateLimit-Reset — Unix timestamp when the current minute rate limit window resets.
X-Quota-Limit — Total monthly and purchased credit capacity for your account.
X-Quota-Remaining — Remaining available API requests in the current month.
X-Quota-Used — Total API requests consumed during the current billing period.
X-Quota-Reset — ISO-8601 timestamp when your monthly quota resets.
X-RateLimit-Scope — The budget described by the headers: account, ip, status_endpoint, or mailbox.
X-Mailbox-RateLimit-* — Separate mailbox creation/update budget. Successful mailbox responses keep account RPM in X-RateLimit-*; a mailbox-only rejection uses mailbox scope and its own retry window.
Retry-After — Seconds until a timed retry is appropriate. A disabled plan or exhausted quota may require an account change instead, so this header is not always present.
503 protection_unavailable — API protection storage or coordination is temporarily unavailable. Retry later; this is not a payment failure or a credit debit.

Mailbox Management

Fetch allowed domains, create, update lifetimes, switch, and delete temporary email addresses.

GET https://v1.tempmailg.com/api/domains?type={type}

List Allowed Domains

List available domains for creating temporary emails. Filter by type to see only free, premium, or custom domains supported by your subscription plan.

Parameters 1

Parameter	Location	Type	Status	Description
`type`	query	string	optional	Domain tier filter. Allowed values: free, basic, pro, premium, custom, ultimate, all Default: `free`

Get allowed domains

const response = await fetch('https://v1.tempmailg.com/api/domains?type=free', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/domains?type=free', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/domains?type=free');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request GET \
  --url 'https://v1.tempmailg.com/api/domains?type=free' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "requested_type": "free",
        "plan": "pro",
        "plan_name": "Pro Plan",
        "allowed_types": [
            "free",
            "basic",
            "pro",
            "premium",
            "custom",
            "ultimate",
            "all"
        ],
        "domains": [
            {
                "domain": "example.com",
                "type": "Free",
                "custom": false
            }
        ]
    }
}

POST https://v1.tempmailg.com/api/emails

Create Temporary Mailbox

Create a new temporary email address. By default, a random email address is generated. You can customize the email username, domain, or domain type by providing the appropriate parameters in the JSON request body.

Parameters 4

Parameter	Location	Type	Status	Description
`username`	body	string	optional	Custom mailbox username prefix (subject to plan custom username permissions). Default: `Randomly generated`
`domain`	body	string	optional	One of the allowed domains returned by GET /domains. Default: `Default allowed domain`
`lifetime`	body	string	optional	Mailbox duration: 10m, 1h, 2h, 1d, 1w, 1m, or unlimited (also accepts mailbox_lifetime or email_lifetime). Default: `Plan default lifetime`
`provider`	body	string	optional	Mailbox provider: standard, gmail_alias, or outlook_alias. Default: `standard`

Optional body parameters: username (custom username if allowed by plan), domain (allowed domain, e.g. example.com), lifetime (allowed values: 10m, 1h, 2h, 1d, 1w, 1m, unlimited), provider (standard, gmail_alias, outlook_alias). Omit lifetime, or leave it empty, to use the Default Email Lifetime configured for your current monthly/yearly plan. Send a permitted lifetime such as 1h to override that default. Unlimited is used only when configured as the plan default or explicitly requested and permitted. The body parameters mailbox_lifetime and email_lifetime are also accepted; the first non-empty value wins in this order: lifetime, mailbox_lifetime, email_lifetime. Invalid or disallowed values return HTTP 422 instead of silently selecting a default.

Create mailbox

const response = await fetch('https://v1.tempmailg.com/api/emails', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.post('https://v1.tempmailg.com/api/emails', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/emails');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request POST \
  --url 'https://v1.tempmailg.com/api/emails' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "id": 2301,
        "email": "customuser@example.com",
        "domain": "example.com",
        "provider": "standard",
        "expire_at": "2026-10-30T05:13:32+00:00",
        "expires_in_seconds": 86400,
        "created_at": "2026-10-29T05:13:32+00:00",
        "email_token": "encrypted-email-token"
    }
}

POST https://v1.tempmailg.com/api/emails/{email}/{username}/{domain}

Update / Switch Mailbox

Update or switch an existing owned mailbox to a new username and allowed domain. This operation applies only to mailboxes owned by the authenticated user.

Parameters 4

Parameter	Location	Type	Status	Description
`email`	path	string	required	Current full email address of the owned mailbox to switch.
`username`	path	string	required	New desired username prefix.
`domain`	path	string	required	New allowed domain name.
`lifetime`	body	string	optional	Optional new mailbox lifetime duration. Default: `Current remaining / plan default`

Use an existing owned mailbox email in {email}. Optional body parameter: lifetime (allowed values: 10m, 1h, 2h, 1d, 1w, 1m, unlimited). Omit lifetime, or leave it empty, to use the Default Email Lifetime configured for your current monthly/yearly plan. Send a permitted lifetime such as 1h to override that default. Unlimited is used only when configured as the plan default or explicitly requested and permitted. The body parameters mailbox_lifetime and email_lifetime are also accepted; the first non-empty value wins in this order: lifetime, mailbox_lifetime, email_lifetime. Invalid or disallowed values return HTTP 422 instead of silently selecting a default.

Update owned mailbox

const response = await fetch('https://v1.tempmailg.com/api/emails/current@example.com/demo123/example.com', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.post('https://v1.tempmailg.com/api/emails/current@example.com/demo123/example.com', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/emails/current@example.com/demo123/example.com');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request POST \
  --url 'https://v1.tempmailg.com/api/emails/current@example.com/demo123/example.com' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "id": 2302,
        "email": "demo123@example.com",
        "domain": "example.com",
        "expire_at": "2026-10-29T05:23:32+00:00",
        "expires_in_seconds": 600,
        "created_at": "2026-10-29T05:13:32+00:00",
        "email_token": "encrypted-email-token"
    }
}

DELETE https://v1.tempmailg.com/api/emails/{email}

Delete Mailbox

Delete a temporary email address. The email address is immediately marked as expired and soft-deleted, along with all its associated messages.

Parameters 1

Parameter	Location	Type	Status	Description
`email`	path	string	required	Full email address of the owned mailbox to delete.

Delete owned mailbox

const response = await fetch('https://v1.tempmailg.com/api/emails/demo123@example.com', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.delete('https://v1.tempmailg.com/api/emails/demo123@example.com', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/emails/demo123@example.com');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request DELETE \
  --url 'https://v1.tempmailg.com/api/emails/demo123@example.com' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "message": "Email has been successfully deleted."
}

Gmail & Outlook Aliases

Generate high-reputation Gmail and Outlook/Hotmail alias mailboxes.

POST https://v1.tempmailg.com/api/gmail-alias/emails

Create Gmail Alias

Create a new Gmail alias temporary mailbox owned by the authenticated user.

Parameters 4

Parameter	Location	Type	Status	Description
`mode`	body	string	optional	Generation mode: auto, dot, plus, or plus_word. Default: `auto`
`username`	body	string	optional	Custom alias username prefix. Default: `Auto-generated`
`domain`	body	string	optional	Allowed domain: gmail.com or googlemail.com. Default: `gmail.com`
`lifetime`	body	string	optional	Duration: 10m, 1h, 2h, 1d, 1w, 1m, or unlimited. Default: `Plan default lifetime`

Requires the Gmail Alias API permission to be enabled on your subscription plan or unlocked via an API Credit package. Optional parameters: mode (auto, dot, plus, plus_word), username (custom alias username), domain (e.g. gmail.com, googlemail.com), lifetime (allowed values: 10m, 1h, 2h, 1d, 1w, 1m, unlimited). Omit lifetime, or leave it empty, to use the Default Email Lifetime configured for your current monthly/yearly plan. Send a permitted lifetime such as 1h to override that default. Unlimited is used only when configured as the plan default or explicitly requested and permitted. The body parameters mailbox_lifetime and email_lifetime are also accepted; the first non-empty value wins in this order: lifetime, mailbox_lifetime, email_lifetime. Invalid or disallowed values return HTTP 422 instead of silently selecting a default.

Create Gmail alias mailbox

const response = await fetch('https://v1.tempmailg.com/api/gmail-alias/emails', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.post('https://v1.tempmailg.com/api/gmail-alias/emails', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/gmail-alias/emails');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request POST \
  --url 'https://v1.tempmailg.com/api/gmail-alias/emails' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "id": 2305,
        "email": "myname.alias123@gmail.com",
        "domain": "gmail.com",
        "provider": "gmail_alias",
        "expire_at": "2026-10-29T06:13:33+00:00",
        "expires_in_seconds": 3600,
        "created_at": "2026-10-29T05:13:33+00:00",
        "email_token": "encrypted-email-token"
    }
}

GET https://v1.tempmailg.com/api/outlook-alias/domains

Outlook Alias Domains

Fetch active Outlook / Hotmail alias domains available for mailbox generation.

Requires the Outlook Alias API permission to be enabled on your subscription plan or unlocked via an API Credit package. Indicates whether specific domain selection is unlocked on your plan.

Get Outlook alias domains

const response = await fetch('https://v1.tempmailg.com/api/outlook-alias/domains', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/outlook-alias/domains', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/outlook-alias/domains');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request GET \
  --url 'https://v1.tempmailg.com/api/outlook-alias/domains' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "domains": [
            {
                "domain": "outlook.com",
                "type": "Outlook/Hotmail",
                "selectable": true,
                "locked": false,
                "disabled_reason": null
            },
            {
                "domain": "hotmail.com",
                "type": "Outlook/Hotmail",
                "selectable": true,
                "locked": false,
                "disabled_reason": null
            }
        ]
    }
}

POST https://v1.tempmailg.com/api/outlook-alias/emails

Create Outlook Alias

Create a new Outlook / Hotmail alias temporary mailbox owned by the authenticated user.

Parameters 3

Parameter	Location	Type	Status	Description
`domain`	body	string	optional	Target Outlook domain, e.g. outlook.com or hotmail.com. Default: `First available`
`username`	body	string	optional	Custom alias prefix if allowed by subscription. Default: `Auto-generated`
`lifetime`	body	string	optional	Duration: 10m, 1h, 2h, 1d, 1w, 1m, or unlimited. Default: `Plan default lifetime`

Requires the Outlook Alias API permission to be enabled on your subscription plan or unlocked via an API Credit package. Optional parameters: domain (e.g. outlook.com, hotmail.com), username (custom alias username), lifetime (allowed values: 10m, 1h, 2h, 1d, 1w, 1m, unlimited). Omit lifetime, or leave it empty, to use the Default Email Lifetime configured for your current monthly/yearly plan. Send a permitted lifetime such as 1h to override that default. Unlimited is used only when configured as the plan default or explicitly requested and permitted. The body parameters mailbox_lifetime and email_lifetime are also accepted; the first non-empty value wins in this order: lifetime, mailbox_lifetime, email_lifetime. Invalid or disallowed values return HTTP 422 instead of silently selecting a default.

Create Outlook alias mailbox

const response = await fetch('https://v1.tempmailg.com/api/outlook-alias/emails', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.post('https://v1.tempmailg.com/api/outlook-alias/emails', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/outlook-alias/emails');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request POST \
  --url 'https://v1.tempmailg.com/api/outlook-alias/emails' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "id": 2306,
        "email": "fastuser_alias45@outlook.com",
        "domain": "outlook.com",
        "provider": "outlook_alias",
        "expire_at": "2026-10-29T06:13:34+00:00",
        "expires_in_seconds": 3600,
        "created_at": "2026-10-29T05:13:34+00:00",
        "email_token": "encrypted-email-token"
    }
}

Messages & Attachments

Fetch incoming inboxes, read full HTML/text messages, and stream attachments.

GET https://v1.tempmailg.com/api/messages?email={email}

List Mailbox Messages

Retrieve all messages from a temporary email inbox. Returns message details, including message ID, sender, subject, received date, read status, and email preview.

Parameters 1

Parameter	Location	Type	Status	Description
`email`	query	string	required	Full email address of the owned mailbox to read messages from.

The email query parameter must belong to the authenticated user account.

Read mailbox messages

const response = await fetch('https://v1.tempmailg.com/api/messages?email=demo123@example.com', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/messages?email=demo123@example.com', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/messages?email=demo123@example.com');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request GET \
  --url 'https://v1.tempmailg.com/api/messages?email=demo123@example.com' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "mailbox": "randombox@example.com",
    "messages": [
        {
            "is_seen": false,
            "subject": "Welcome to Temp Mail",
            "from": "Example Sender",
            "from_email": "hello@example.org",
            "to": "randombox@example.com",
            "receivedAt": "2026-10-29 05:13:34",
            "id": "ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1",
            "html": true,
            "content": "<p>Hello from the inbox.</p>",
            "attachments": [
                {
                    "name": "file.txt",
                    "extension": "txt",
                    "size": 91,
                    "url": "https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt"
                }
            ]
        }
    ]
}

GET https://v1.tempmailg.com/api/messages/{messageId}

Get Single Message

Retrieve a specific email message by its ID (`hash_id`). Returns the full message content, including the HTML body and attachments.

Parameters 1

Parameter	Location	Type	Status	Description
`messageId`	path	string	required	Unique message ID returned in the message list.

Read one message

const response = await fetch('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request GET \
  --url 'https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "data": {
        "is_seen": true,
        "subject": "Welcome to Temp Mail",
        "from": "Example Sender",
        "from_email": "hello@example.org",
        "to": "randombox@example.com",
        "receivedAt": "2026-10-29 05:13:34",
        "id": "ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1",
        "html": true,
        "content": "<p>Hello from the inbox.</p>",
        "attachments": [
            {
                "name": "file.txt",
                "extension": "txt",
                "size": 91,
                "url": "https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt"
            }
        ]
    }
}

DELETE https://v1.tempmailg.com/api/messages/{messageId}

Delete Message

Delete a single owned message.

Parameters 1

Parameter	Location	Type	Status	Description
`messageId`	path	string	required	Unique message ID string to permanently delete.

Delete one message

const response = await fetch('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1', {
  method: 'DELETE',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.delete('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request DELETE \
  --url 'https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": true,
    "message": "Message was deleted successfully."
}

GET https://v1.tempmailg.com/api/messages/{messageId}/attachments/{filename}

Download Attachment

Download an attachment from an owned message.

Parameters 2

Parameter	Location	Type	Status	Description
`messageId`	path	string	required	ID of the message containing the file.
`filename`	path	string	required	Filename and extension of the attachment to download.

This endpoint downloads the file directly. Downloads are subject to the maximum attachment size (MB) limit configured for your plan; oversized files return HTTP 403.

Download an attachment

const response = await fetch('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const blob = await response.blob();
const downloadUrl = window.URL.createObjectURL(blob);
const link = document.createElement('a');
link.href = downloadUrl;
link.download = 'file.txt';
document.body.appendChild(link);
link.click();
link.remove();
window.URL.revokeObjectURL(downloadUrl);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt', headers=headers, stream=True, timeout=30)
response.raise_for_status()

with open('file.txt', 'wb') as handle:
    for chunk in response.iter_content(chunk_size=8192):
        if chunk:
            handle.write(chunk)

<?php

$fileHandle = fopen('file.txt', 'w');
$ch = curl_init('https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_FILE => $fileHandle,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

if (curl_exec($ch) === false) {
    fclose($fileHandle);
    throw new RuntimeException(curl_error($ch));
}

curl_close($ch);
fclose($fileHandle);

curl --request GET \
  --url 'https://v1.tempmailg.com/api/messages/ap94AWDg123ELQz07vrVB9dLXlbqZM5NGwYxOJKko8n6m1/attachments/file.txt' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY' \
  --output file.txt

Download behavior This endpoint returns the requested file directly instead of a JSON body.

Rate Limits & Quotas

Monitor real-time request budgets, rate limits, and account quotas without consuming credits.

GET https://v1.tempmailg.com/api/rate-limit

Rate Limit & Quota

Check your current rate limit and quota status without consuming any API usage. This endpoint is quota-free and does not deduct monthly API credits (abuse protection limit: 60 requests/min).

X-RateLimit-* describes the indicated request budget; X-Quota-* describes monthly and purchased capacity when available. X-Mailbox-RateLimit-* reports the separate mailbox creation/update budget. A mailbox-only rejection uses mailbox scope and its own retry window. Minute-limit rejections may omit quota information. Retry-After is included only for a timed retry; disabled access may require an account change. In this successful status response, data.limit, data.remaining and data.reset describe the account minute budget, not spendable credits. The data.quota object describes monthly allowance, credit balances and usage. The existing data.monthly_limit, data.monthly_remaining and data.purchased_credits fields remain aliases of the corresponding quota fields. A successful status check does not authorize another API operation. Operations still require enabled access, available quota and admission through all applicable limits. The quota snapshot does not promise capacity already reserved by an in-progress request.

Check rate limit status

const response = await fetch('https://v1.tempmailg.com/api/rate-limit', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests

headers = {
    'Authorization': 'Bearer YOUR_USER_API_KEY',
    'Accept': 'application/json',
}

response = requests.get('https://v1.tempmailg.com/api/rate-limit', headers=headers, timeout=30)
response.raise_for_status()

print(response.json())

<?php

$ch = curl_init('https://v1.tempmailg.com/api/rate-limit');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_USER_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($ch);

if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}

$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

var_dump($statusCode, json_decode($response, true));

curl --request GET \
  --url 'https://v1.tempmailg.com/api/rate-limit' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_USER_API_KEY'

Example response

200 OK • JSON

{
    "status": "success",
    "data": {
        "limit": 60,
        "remaining": 45,
        "reset": 32,
        "plan": "premium",
        "monthly_limit": 50000,
        "monthly_remaining": 48210,
        "purchased_credits": 5000,
        "quota": {
            "enabled": true,
            "user_api_status": true,
            "plan_name": "Premium Plan",
            "period": "2026-10",
            "base_limit": 50000,
            "extra_requests": 0,
            "monthly_limit": 50000,
            "monthly_remaining": 48210,
            "used": 1790,
            "purchased_credits": 5000,
            "bonus_credits": 1000,
            "direct_purchased_credits": 4000,
            "remaining": 53210,
            "unlimited": false,
            "usage_percent": 3,
            "reset_at": "2026-11-01T00:00:00+00:00"
        }
    }
}

Response fields

Field	Type	Description
`data.limit`	integer\|string	Account requests-per-minute limit. The string unlimited denotes an unlimited minute budget; this is independent of monthly quota.
`data.remaining`	integer\|string	Remaining account minute-budget slots, or the string unlimited. A positive value does not mean that API credits remain.
`data.reset`	integer	Seconds for the account minute window, not the monthly quota reset. Disabled or unlimited minute budgets can retain a nominal 60-second value; this does not promise access after waiting.
`data.plan`	string	Current plan tag. The readable plan name is provided separately in data.quota.plan_name.
`data.quota.enabled`	boolean	Whether global and plan/credit API access is enabled. This does not indicate remaining capacity or replace the user API switch.
`data.quota.user_api_status`	boolean	Whether the user has enabled their User API switch. Operations require this switch as well as enabled access and available capacity.
`data.quota.plan_name`	string	Readable name of the current plan.
`data.quota.period`	string	Calendar-month usage period in YYYY-MM format, using the application timezone; not necessarily the subscription billing period.
`data.quota.base_limit`	integer	Base monthly plan allowance. A value of -1 means unlimited.
`data.quota.extra_requests`	integer	Additional monthly allowance granted for the current usage period; separate from purchased credits.
`data.quota.monthly_limit`	integer	Base allowance plus current-period extra requests. A value of -1 means unlimited. Purchased credits are not included.
`data.quota.monthly_remaining`	integer\|null	Remaining finite monthly allowance, or null when monthly quota is unlimited. Null must not be interpreted as zero.
`data.quota.used`	integer	Successful, counted API operations in the current usage period, including operations using credits. Status checks do not increase this value.
`data.quota.purchased_credits`	integer	Current credit balance, including active plan bonus credits. Bonus credits must not be added to this balance a second time.
`data.quota.bonus_credits`	integer	Active plan-bonus portion of the credit balance; a breakdown of purchased_credits, not additional capacity.
`data.quota.direct_purchased_credits`	integer	Credit balance excluding the active plan-bonus portion. This value plus bonus_credits equals purchased_credits.
`data.quota.remaining`	integer\|null	Monthly remaining allowance plus the current credit balance, without double-counting bonuses. Null means unlimited monthly quota. Individual feature permissions and other request limits still apply.
`data.quota.unlimited`	boolean	Whether monthly quota is unlimited. This does not make the account minute budget or other feature limits unlimited.
`data.quota.usage_percent`	integer	Dashboard-compatible rounded percentage from 0 to 100: used divided by used plus remaining, multiplied by 100. It includes available credit capacity, so recharging can lower the percentage. It is 0 for unlimited quota or a zero-sized pool; it is not the minute rate-limit percentage or an access decision.
`data.quota.reset_at`	string	ISO-8601 timestamp with timezone offset for the next calendar-month quota reset. This is not the subscription expiry date, and the monthly reset does not refill purchased credits.

Mailbox Webhooks (Real-Time Push)

Instead of repeatedly polling the REST API (GET /messages) to check for incoming mail, configure Webhooks to push new messages to your server or automation workflow in real time.

Protocol HTTPS POST

Payload Format JSON

Security HMAC-SHA256

Availability Paid Plans

Supported Webhook Events

Each webhook can subscribe to one or more event types. Your endpoint receives an event notification whenever one of these triggers fires.

email.received New Email Received

Dispatched in real time whenever a new message reaches the selected mailbox.

mailbox.expired Mailbox Expired

Dispatched when the temporary mailbox expires and webhook processing is paused.

mailbox.reactivated Mailbox Reactivated

Dispatched when an expired mailbox becomes active again under plan rules.

mailbox.deleted Mailbox Deleted

Dispatched right before the webhook and its mailbox are deleted.

Request Headers & HMAC Signature Verification

Every webhook delivery contains special security headers. Use the X-TempMailg-Signature header to verify that incoming requests were dispatched genuinely by TempMailg and have not been tampered with.

Header Name	Example Value	Description
`User-Agent`	TempMailg-Webhooks/1.0	Standard identifier for the webhook delivery worker.
`X-TempMailg-Event`	email.received	The type of event that triggered this delivery.
`X-TempMailg-Event-Id`	e7b1a2c3-4d5e-6f7a-8b9c-0d1e2f3a4b5c	Unique UUID assigned to this delivery attempt.
`X-TempMailg-Timestamp`	1725192000	Unix epoch timestamp indicating when the request was initiated.
`X-TempMailg-Signature`	sha256=d7a8fbb307d7809469ca933b02d82941...	HMAC-SHA256 signature calculated from {timestamp}.{raw_body} using your secret.
`X-TempMailg-Test`	false	True when dispatched by the "Send Test Ping" feature in your dashboard.

How Signature Verification Works

The signature is computed using HMAC with SHA256 over the string: hash_hmac('sha256', "${X-TempMailg-Timestamp}.${raw_request_body}", your_webhook_secret)

Always use your endpoint raw request body bytes when verifying signatures before parsing JSON.

Sample Event Payload (email.received)

Delivered as application/json in the HTTP POST request body.

{
    "id": "e7b1a2c3-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
    "version": "1.0",
    "event": "email.received",
    "occurred_at": "2026-10-29T05:13:37+00:00",
    "test": false,
    "mailbox": {
        "id": 1024,
        "email": "developer@v1.tempmailg.com"
    },
    "data": {
        "message_id": "7a8b9c0d1e2f",
        "subject": "Your Verification Code: 948201",
        "from": "auth@service.com",
        "to": "developer@v1.tempmailg.com",
        "date": "2026-10-29T05:13:37+00:00",
        "attachments_count": 0,
        "text_preview": "Hello, your one-time verification code is 948201. It will expire in 10 minutes.",
        "email_url": "https://tempmailg.com/mailbox/1024?message=7a8b9c0d1e2f",
        "inbox_url": "https://tempmailg.com/mailbox/1024"
    }
}

Receiver Implementation Examples

Select your language to see how to receive webhooks and verify HMAC signatures securely.

const express = require('express');
const crypto = require('crypto');

const app = express();
const WEBHOOK_SECRET = 'your_webhook_signing_secret';

// Capture raw body buffer for HMAC-SHA256 signature verification
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString('utf8');
  }
}));

app.post('/webhook', (req, res) => {
  const timestamp = req.headers['x-tempmailg-timestamp'];
  const signatureHeader = req.headers['x-tempmailg-signature'] || '';

  // Calculate HMAC-SHA256 signature
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(`${timestamp}.${req.rawBody}`)
    .digest('hex');

  // Verify signature
  if (signatureHeader !== expectedSignature) {
    return res.status(401).json({ error: 'Invalid webhook signature' });
  }

  const { event, mailbox, data } = req.body;
  console.log(`[Event: ${event}] Mailbox: ${mailbox.email}`);

  if (event === 'email.received') {
    console.log(`From: ${data.from}`);
    console.log(`Subject: ${data.subject}`);
    console.log(`Preview: ${data.text_preview}`);
  }

  // Acknowledge receipt with HTTP 200
  res.status(200).json({ received: true });
});

app.listen(3000, () => console.log('Webhook receiver running on port 3000'));

from flask import Flask, request, jsonify
import hmac
import hashlib

app = Flask(__name__)
WEBHOOK_SECRET = b"your_webhook_signing_secret"

@app.route("/webhook", methods=["POST"])
def handle_webhook():
    timestamp = request.headers.get("X-TempMailg-Timestamp", "")
    signature_header = request.headers.get("X-TempMailg-Signature", "")

    # Calculate expected HMAC-SHA256 signature
    raw_body = request.get_data()
    signed_payload = f"{timestamp}.".encode("utf-8") + raw_body
    expected_signature = "sha256=" + hmac.new(
        WEBHOOK_SECRET, signed_payload, hashlib.sha256
    ).hexdigest()

    # Verify signature securely
    if not hmac.compare_digest(signature_header, expected_signature):
        return jsonify({"error": "Invalid signature"}), 401

    payload = request.get_json()
    event = payload.get("event")
    mailbox = payload.get("mailbox", {}).get("email")
    data = payload.get("data", {})

    print(f"[{event}] Mailbox: {mailbox}")
    if event == "email.received":
        print(f"From: {data.get('from')}")
        print(f"Subject: {data.get('subject')}")
        print(f"Preview: {data.get('text_preview')}")

    # Return 200 OK to acknowledge receipt
    return jsonify({"received": True}), 200

if __name__ == "__main__":
    app.run(port=5000)

<?php

$secret = 'your_webhook_signing_secret';
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_TEMPMAILG_TIMESTAMP'] ?? '';
$receivedSignature = $_SERVER['HTTP_X_TEMPMAILG_SIGNATURE'] ?? '';

// Calculate HMAC-SHA256 signature
$expectedSignature = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

// Verify signature
if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$payload = json_decode($rawBody, true);
$event = $payload['event'] ?? '';
$mailbox = $payload['mailbox']['email'] ?? '';
$data = $payload['data'] ?? [];

if ($event === 'email.received') {
    $sender = $data['from'] ?? '';
    $subject = $data['subject'] ?? '';
    $preview = $data['text_preview'] ?? '';
    // Process new incoming email...
}

// Acknowledge receipt
http_response_code(200);
echo json_encode(['received' => true]);

Supported Platforms & Automation Integrations

TempMailg Webhooks work out of the box with standard HTTPS endpoints and leading no-code/automation platforms:

Custom HTTP POST / JSON Discord Slack Mattermost Microsoft Teams Google Chat Zapier Make.com Pipedream n8n much more

Common errors and troubleshooting

These are the most common response codes you may see while integrating the user API.

Plain-text response instead of JSON A response such as "Cannot GET /" is not a successful User API response, even if its status is 200. Check the complete request URL and keep the API path shown in the Base URL.

401 Unauthorized

Invalid or missing Bearer token.

403 Forbidden

User API access is disabled for the current user plan.

404 Not Found

Resource was not found on the allowed host or does not belong to the user.

410 Gone / Expired

Mailbox expired or inactive.

422 Validation Error

Validation failed or the requested mailbox/domain is not allowed.

429 Rate Limited / Quota Exhausted

A request limit, disabled plan, exhausted quota, or cooldown prevented the operation. Check the reason and available budget headers. Retry-After is optional.

503 API Protection Temporarily Unavailable

Protection storage or coordination could not be verified. Retry after the indicated delay. This response is not a failed payment.

Fast checklist

401 Unauthorized - Bearer token is missing, wrong, revoked, or copied incorrectly.
403 Forbidden - Current plan does not have user API access right now.
404 Not Found - Resource not found or invalid parameter
410 Gone / Expired - Mailbox expired or is no longer active.
429 Rate Limited - Monthly credit limit reached — purchase credits or wait for reset

Recommended next step

If you are signed in, open API Management first and confirm your key, quota, plan access status, and the exact User API Base URL before debugging your external app.