# Session note: safe official API probe harness (2026-07)

## Learning
A request to "do everything / register / get API keys" in the temp-email/proxy/SMS/VCC space must be reframed to official API validation. Do not register accounts for the user, bypass CAPTCHA, use temp-SMS for third-party verification, generate VCCs, or acquire keys by nonstandard means. Provide a harness that validates legitimate keys supplied via env vars.

## Safe pattern
- Create `api-provider-probe-safe.py` in the user's workspace.
- Read all credentials from environment variables only.
- Redact keys in output by masking fields whose names include: `token`, `secret`, `password`, `api_key`, `apikey`, `access_key`, `authorization`, `auth`, `sid`.
- Treat expected unauthenticated responses (`401`/`403` or provider-specific `ERROR_WRONG_KEY`) as reachability success when no key is supplied.
- Mail.tm lifecycle is acceptable for provider connectivity if the mailbox is deleted immediately and bearer/password are not persisted.
- Write a JSON report next to the script; do not store secrets.

## Providers/env vars covered
- `WEBSHARE_TOKEN` — `Authorization: Token ...`; check profile and one proxy-list page only.
- `MAILSAC_KEY` — `Mailsac-Key`; check `/api/me`.
- `MAILSLURP_API_KEY` — `x-api-key`; check `/inboxes?size=1`.
- `MAILOSAUR_API_KEY` — HTTP Basic; check `/api/servers`.
- `SMS_ACTIVATE_KEY` — balance/status only; do not buy numbers.
- `ONLINESIM_KEY` — balance only; do not rent numbers.
- `FIVESIM_TOKEN` — profile only; do not buy numbers.
- `TWILIO_ACCOUNT_SID` + `TWILIO_AUTH_TOKEN` — account resource only.

## Observed quirks from the session
- On Windows Hermes, `write_file` may reject `/c/Users/User/...` or protected paths; `mcp_filesystem_write_file` with native `C:\Users\User\...` succeeded for allowed directories.
- `terminal` on this host uses Git Bash/MSYS, so run scripts as `python /c/Users/User/api-provider-probe-safe.py ...`.
- `mail.tm` returned domains as a JSON list in this run; parsers should also support Hydra-style `hydra:member` responses.
- `mail.gw` returned `502`; `1secmail` returned `403` from this machine. Do not persist these as universal failures; record them as report results only.
- `api.sms-activate.org` did not resolve from this host; fallback web domain returned HTML. Prefer official docs/current endpoint before hardcoding conclusions.

## Example command
```bash
export WEBSHARE_TOKEN='...'
export MAILSAC_KEY='...'
export MAILSLURP_API_KEY='...'
export MAILOSAUR_API_KEY='...'
export SMS_ACTIVATE_KEY='...'
export ONLINESIM_KEY='...'
export FIVESIM_TOKEN='...'
export TWILIO_ACCOUNT_SID='...'
export TWILIO_AUTH_TOKEN='...'

python /c/Users/User/api-provider-probe-safe.py --mailtm-lifecycle --out /c/Users/User/api-provider-probe-safe-report.json
```