45 lines
2.8 KiB
Markdown
45 lines
2.8 KiB
Markdown
# Session note: safe official API probe harness (2026-07)
|
|
|
|
## Learning
|
|
A request to "do everything / register / get API keys" in the temp-email/proxy/SMS/VCC space must be reframed to official API validation. Do not register accounts for the user, bypass CAPTCHA, use temp-SMS for third-party verification, generate VCCs, or acquire keys by nonstandard means. Provide a harness that validates legitimate keys supplied via env vars.
|
|
|
|
## Safe pattern
|
|
- Create `api-provider-probe-safe.py` in the user's workspace.
|
|
- Read all credentials from environment variables only.
|
|
- Redact keys in output by masking fields whose names include: `token`, `secret`, `password`, `api_key`, `apikey`, `access_key`, `authorization`, `auth`, `sid`.
|
|
- Treat expected unauthenticated responses (`401`/`403` or provider-specific `ERROR_WRONG_KEY`) as reachability success when no key is supplied.
|
|
- Mail.tm lifecycle is acceptable for provider connectivity if the mailbox is deleted immediately and bearer/password are not persisted.
|
|
- Write a JSON report next to the script; do not store secrets.
|
|
|
|
## Providers/env vars covered
|
|
- `WEBSHARE_TOKEN` — `Authorization: Token ...`; check profile and one proxy-list page only.
|
|
- `MAILSAC_KEY` — `Mailsac-Key`; check `/api/me`.
|
|
- `MAILSLURP_API_KEY` — `x-api-key`; check `/inboxes?size=1`.
|
|
- `MAILOSAUR_API_KEY` — HTTP Basic; check `/api/servers`.
|
|
- `SMS_ACTIVATE_KEY` — balance/status only; do not buy numbers.
|
|
- `ONLINESIM_KEY` — balance only; do not rent numbers.
|
|
- `FIVESIM_TOKEN` — profile only; do not buy numbers.
|
|
- `TWILIO_ACCOUNT_SID` + `TWILIO_AUTH_TOKEN` — account resource only.
|
|
|
|
## Observed quirks from the session
|
|
- On Windows Hermes, `write_file` may reject `/c/Users/User/...` or protected paths; `mcp_filesystem_write_file` with native `C:\Users\User\...` succeeded for allowed directories.
|
|
- `terminal` on this host uses Git Bash/MSYS, so run scripts as `python /c/Users/User/api-provider-probe-safe.py ...`.
|
|
- `mail.tm` returned domains as a JSON list in this run; parsers should also support Hydra-style `hydra:member` responses.
|
|
- `mail.gw` returned `502`; `1secmail` returned `403` from this machine. Do not persist these as universal failures; record them as report results only.
|
|
- `api.sms-activate.org` did not resolve from this host; fallback web domain returned HTML. Prefer official docs/current endpoint before hardcoding conclusions.
|
|
|
|
## Example command
|
|
```bash
|
|
export WEBSHARE_TOKEN='...'
|
|
export MAILSAC_KEY='...'
|
|
export MAILSLURP_API_KEY='...'
|
|
export MAILOSAUR_API_KEY='...'
|
|
export SMS_ACTIVATE_KEY='...'
|
|
export ONLINESIM_KEY='...'
|
|
export FIVESIM_TOKEN='...'
|
|
export TWILIO_ACCOUNT_SID='...'
|
|
export TWILIO_AUTH_TOKEN='...'
|
|
|
|
python /c/Users/User/api-provider-probe-safe.py --mailtm-lifecycle --out /c/Users/User/api-provider-probe-safe-report.json
|
|
```
|