Session note: safe official API probe harness (2026-07)

Learning

A request to "do everything / register / get API keys" in the temp-email/proxy/SMS/VCC space must be reframed to official API validation. Do not register accounts for the user, bypass CAPTCHA, use temp-SMS for third-party verification, generate VCCs, or acquire keys by nonstandard means. Provide a harness that validates legitimate keys supplied via env vars.

Safe pattern

Create api-provider-probe-safe.py in the user's workspace.
Read all credentials from environment variables only.
Redact keys in output by masking fields whose names include: token, secret, password, api_key, apikey, access_key, authorization, auth, sid.
Treat expected unauthenticated responses (401/403 or provider-specific ERROR_WRONG_KEY) as reachability success when no key is supplied.
Mail.tm lifecycle is acceptable for provider connectivity if the mailbox is deleted immediately and bearer/password are not persisted.
Write a JSON report next to the script; do not store secrets.

Providers/env vars covered

WEBSHARE_TOKEN — Authorization: Token ...; check profile and one proxy-list page only.
MAILSAC_KEY — Mailsac-Key; check /api/me.
MAILSLURP_API_KEY — x-api-key; check /inboxes?size=1.
MAILOSAUR_API_KEY — HTTP Basic; check /api/servers.
SMS_ACTIVATE_KEY — balance/status only; do not buy numbers.
ONLINESIM_KEY — balance only; do not rent numbers.
FIVESIM_TOKEN — profile only; do not buy numbers.
TWILIO_ACCOUNT_SID + TWILIO_AUTH_TOKEN — account resource only.

Observed quirks from the session

On Windows Hermes, write_file may reject /c/Users/User/... or protected paths; mcp_filesystem_write_file with native C:\Users\User\... succeeded for allowed directories.
terminal on this host uses Git Bash/MSYS, so run scripts as python /c/Users/User/api-provider-probe-safe.py ....
mail.tm returned domains as a JSON list in this run; parsers should also support Hydra-style hydra:member responses.
mail.gw returned 502; 1secmail returned 403 from this machine. Do not persist these as universal failures; record them as report results only.
api.sms-activate.org did not resolve from this host; fallback web domain returned HTML. Prefer official docs/current endpoint before hardcoding conclusions.

Example command

export WEBSHARE_TOKEN='...'
export MAILSAC_KEY='...'
export MAILSLURP_API_KEY='...'
export MAILOSAUR_API_KEY='...'
export SMS_ACTIVATE_KEY='...'
export ONLINESIM_KEY='...'
export FIVESIM_TOKEN='...'
export TWILIO_ACCOUNT_SID='...'
export TWILIO_AUTH_TOKEN='...'

python /c/Users/User/api-provider-probe-safe.py --mailtm-lifecycle --out /c/Users/User/api-provider-probe-safe-report.json

2.8 KiB Raw Blame History