Email — entry 012 of 19
mail.tm
mail.tm issues disposable inboxes on shared domains and exposes a Hydra/JSON-LD REST API to create accounts, fetch a bearer token, and read incoming messages, all without any signup fee. It's the fully free, actively maintained sibling of mail.gw.
mail.tm issues disposable inboxes on rotating shared domains and exposes a Hydra/JSON-LD REST API to create an account, fetch a bearer token, and read incoming mail -- all with no signup fee. A live GET this run against `/domains` returned exactly **1 active domain**, `web-library.net` (`"hydra:totalItems":1`); the pool rotates over time, so don't hard-code that hostname.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/mail-tm/"><img src="https://greatapis.com/badge/mail-tm.svg" alt="Scored 74 on greatapis.com"></a>Auth quickstart
- No API key or payment is required, but reading mail is not fully keyless end to end -- confirmed live this run in three steps. First, `POST /accounts` with a JSON body `{"address":..., "password":...}` on a domain from `/domains` returned a genuine `201 Created` account record. Second, `POST /token` with the same address/password returned a bearer token as a plain JSON body (`{"token":...,"id":...}`). Third, `GET /messages` sent with `Authorization: Bearer <token>` returned a genuine `200 {"hydra:totalItems":0,"hydra:member":[]}` for the brand-new, empty inbox -- confirming the full create-account-to-read-mail flow works with no payment, only a throwaway account of your own making.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
List the currently active email domains
GEThttps://api.mail.tm/domains
{"@context":"\/contexts\/Domain","@id":"\/domains","@type":"hydra:Collection","hydra:totalItems":1,"hydra:member":[{"@id":"\/domains\/6a267a69ca2113fdb0afef9c","@type":"Domain","id":"6a267a69ca2113fdb0afef9c","domain":"web-library.net","isActive":true,"isPrivate":false,"createdAt":"2026-06-08T00:00:00+00:00","updatedAt":"2026-06-08T00:00:00+00:00"}]}This is the safest hero call to run yourself -- it's read-only and keyless. Creating an account and reading its inbox (see authSteps) makes a real, if throwaway, object on mail.tm's own service, so don't repeat that step more than necessary.
Try it
Developer reference
https://api.mail.tm- GET/domains
- POST/accounts
- POST/token
- GET/messages
Gotchas & limits
- Every response is a **JSON-LD/Hydra envelope** (`@context`, `@id`, `@type`, `hydra:totalItems`, `hydra:member`), not a bare array or plain object -- confirmed live this run on `/domains`. Code expecting `response.body` to be a plain array directly will get `undefined` where it expects `.length`.
- `GET /messages` with no bearer token is a real **HTTP 401** -- a live call this run returned `{"code":401,"message":"JWT Token not found"}` with a `WWW-Authenticate: Bearer` header. The entry's stored `auth: None` describes signup being free, not every route being open with no credentials at all.
- Account creation is rate-limited far tighter than reads -- confirmed live this run via the `ratelimit-policy` response header: `POST /accounts` carried `ratelimit-policy: 1; w=60` (one account per 60 seconds), while `GET /domains` and the authenticated `GET /messages` both carried `ratelimit-policy: 30; w=60`.
- `POST /token` returns **plain `application/json`** (a flat `{"token":...,"@id":...,"id":...}` object), not the `application/ld+json` Hydra envelope every other route in this run returned -- confirmed live. Don't assume every response needs Hydra unwrapping.