Disposable inboxes, over HTTP

Every /v1 request carries your key as a bearer token. Keys start with fk_, belong to an account, and inherit that account's plan — holding two keys does not buy two allowances. Only a hash is stored, so a key is shown once and a lost one is revoked rather than recovered.

Authorization: Bearer fk_...

Counted per account, per calendar month in UTC. Every response carries what is left, so a client can back off before it runs out.

X-Plan: free
X-Quota-Limit: 1000
X-Quota-Remaining: 998

Over the per-minute ceiling answers 429 with Retry-After; over the monthly quota answers 429 naming the plan. A waiting call costs one request however long it waits, which makes /wait cheaper than polling as well as faster.

These are fana.jstnlt.my.id's numbers, read from this instance — a deployment you run yourself sets its own.

An inbox is an address this instance will accept mail for, held for as long as your plan keeps mail. Inboxes minted here are private: only your account's keys can read what arrives.

Reading one message also returns the codes and links pulled out of it. Listings don't carry that — see Extraction below.

Push instead of poll, for callers that cannot hold a connection open — a serverless function, a short CI step. Endpoints belong to the account, so rotating a key does not stop deliveries. Only mail your account owns is sent; a public inbox has nobody to notify.

What your key is, what plan it inherits, and what is left of it.

What the website itself runs on. No key, no quota beyond a per-IP rate limit, and no privacy: every inbox here is readable by anyone who knows the address. Good for a quick look, wrong for anything you would automate.

Every delivery carries X-Fana-Signature: an HMAC-SHA256 of <timestamp>.<raw body> using the endpoint's signing secret. Check it before trusting the payload — anyone who learns your URL can post to it otherwise. The timestamp is signed too, so a captured request stops working once it is older than five minutes.

import { createHmac, timingSafeEqual } from "node:crypto";

// The raw body, before any JSON parsing — re-serializing changes the bytes.
export function verify(secret, rawBody, header) {
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((p) => p.trim().split("=")),
  );
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Answer 2xx to accept a delivery. Anything else is retried with a growing delay — seconds, then minutes, then hours — and given up on after six attempts. An endpoint whose deliveries keep failing is paused, and you turn it back on in the dashboard once it is fixed.

Reading a single message also returns what the mail was probably sent for. codes is ordered by how close each candidate sits to a word naming it, so codes[0] is the one to type. Numbers inside tracking links, prices, phone numbers and copyright years are excluded, and when nothing in the mail is called a code the list is empty rather than a guess.

{
  "message": {
    "subject": "Confirm your email",
    "extracted": {
      "codes": ["483920"],
      "links": ["https://example.com/verify?t=abc123"]
    }
  }
}

Listings do not carry it — extraction is for the message you opened, and running it over a hundred rows nobody read would be pure work.

Errors are JSON with an error string. A private message belonging to another account answers 404 rather than 403, so nothing is confirmed about an address you do not own.

Mail is accepted for 2 domains right now. Any of them can be asked for by name when minting an inbox; omit the domain and one is picked at random.

• tmp.sinikoding.dev
• tmp.pgl.my.id

Community domains are self-service, so the set changes without notice and can grow well past what is worth printing. Read it at run time rather than copying from here.

curl https://fana.jstnlt.my.id/api/domains