34 lines
2.4 KiB
Markdown
34 lines
2.4 KiB
Markdown
# Safe API provider probes — verified notes
|
|
|
|
Session learning: when validating temp-email/proxy/SMS providers, separate provider API testing from third-party account registration. Use official docs/OpenAPI and harmless endpoints; keep credentials in environment variables and redact output.
|
|
|
|
## Verified endpoint status
|
|
|
|
| Provider | Endpoint / doc | Result | Auth |
|
|
|---|---|---:|---|
|
|
| Mail.tm | `GET https://api.mail.tm/domains` | 200 | none |
|
|
| Mail.tm | lifecycle: `POST /accounts` → `POST /token` → `GET /me` → `DELETE /accounts/{id}` | 201/200/200/204 | bearer token after mailbox creation |
|
|
| Mailsac | `https://mailsac.com/openapi-with-examples.json` | 200 OpenAPI | none |
|
|
| Mailsac | `GET https://mailsac.com/api/me` | 200 `null` without key; account object with key | `Mailsac-Key` for account data |
|
|
| Webshare | `GET https://proxy.webshare.io/api/v2/proxy/list/?mode=direct&page_size=1` | 401 without key | `Authorization: Token <TOKEN>` |
|
|
| MailSlurp | `GET https://api.mailslurp.com/inboxes?size=1` | 401 without key | `x-api-key` |
|
|
| Mailosaur | `GET https://mailosaur.com/api/servers` | 401 without key | HTTP Basic |
|
|
| 1secmail | `GET https://www.1secmail.com/api/v1/?action=getDomainList` | 403 from tested host | none, but may block |
|
|
| mail.gw | `GET https://api.mail.gw/domains` | 502 during test | none, unstable at test time |
|
|
|
|
## Provider docs/auth anchors
|
|
|
|
- Mail.tm docs: `https://docs.mail.tm/`; no API key; mailbox account + bearer token; 8 QPS per IP noted in docs.
|
|
- Webshare API docs: `https://apidocs.webshare.io/`; token header: `Authorization: Token <TOKEN>`; proxy list endpoint requires `mode=direct|backbone`.
|
|
- Mailsac OpenAPI: `https://mailsac.com/openapi-with-examples.json`; key header `Mailsac-Key`; free accounts can create an API key per docs.
|
|
- MailSlurp API docs: `https://www.mailslurp.com/docs/api/`; header `x-api-key`.
|
|
- Mailosaur API docs: `https://mailosaur.com/docs/api`; HTTP Basic auth with API key.
|
|
|
|
## Safe test pattern
|
|
|
|
1. Probe public docs/OpenAPI and no-auth endpoints.
|
|
2. If a provider key is needed, ask the user to set it in env (`WEBSHARE_TOKEN`, `MAILSAC_KEY`, `MAILSLURP_API_KEY`, `MAILOSAUR_API_KEY`) rather than pasting into chat.
|
|
3. Run the reusable harness from `scripts/api-provider-probe.py`.
|
|
4. Include only status codes, latency, and redacted samples in the report.
|
|
5. For Mail.tm lifecycle, delete the temporary mailbox immediately after `/me` succeeds.
|