Test email OTP flows without a shared inbox

What to test in an email OTP flow

• The code arrives at a brand-new address, not only at addresses your team has used before.
• The code in the email matches what your backend issued, with the length and characters you expect.
• An expired code is rejected, and the message tells the user what to do next.
• A code that has been used cannot be used again.
• Requesting a new code invalidates the previous one, if that is the behavior you intend.
• Resending is rate-limited, and the limit is explained to the user.
• Repeated wrong attempts slow down or lock verification.
• The email is readable without images, and the code copies without stray spaces.
• Links in the same email point at the environment under test, not at production.

Manual testing in the browser

1. Install the MailBots extension for Chrome, Edge or Firefox.
2. Copy the disposable address from the popup and paste it into the form under test.
3. When the email arrives, MailBots shows the detected code with a Copy button. Paste it into the form.
4. Select New address to repeat the test from a clean state.

Because every address is new, you test the path a real first-time user takes, not an inbox full of earlier codes.

Automated testing through the API

For CI, give your tests a catch-all subdomain such as otp.example.com. Each test invents its own address, triggers the email, then asks the MailBots API for the newest message sent to that address. The response already contains the extracted code in the otp field.

curl -sS 'https://api.mailbots.top/v1/messages?limit=50' \
  -H 'Authorization: Bearer mb_live_REPLACE_ME'

Match the message on envelope_to and read otp. The Playwright guide and the Cypress guide show complete tests. If you would rather be notified than poll, a signed webhook posts each message, code included, to your endpoint.

How MailBots finds the code

MailBots reads the subject and the text of each message and scores every candidate that looks like a code:

• plain numeric codes of 4 to 8 digits, such as 847291;
• grouped codes such as 847 291 or 847-291;
• provider formats such as Google's G-847291;
• letter-and-digit codes of 6 to 8 characters, such as A7K2Q9.

Candidates score higher when words such as code, verification, OTP, one-time, sign in or 2FA appear just before them, or when they sit in the subject or near the top of the message. They score lower when they look like a phone number, a year, a time or a price. When no candidate is convincing, MailBots shows no code rather than a wrong one, and the full message is still there to read.

Limits worth knowing

• Free addresses use the shared mailbots.top domain, which some services block as disposable. For flows that must accept your own domain, use a catch-all subdomain.
• Free messages are kept for 24 hours; catch-all messages for 72 hours.
• MailBots only receives. It cannot send the OTP email for you or reply to it.
• How quickly a code arrives depends mostly on the service sending it. MailBots shows the message as soon as it is received.

Questions

Can I test OTP emails without writing code?

Yes. The free browser extension covers manual testing: copy an address, trigger the email and copy the highlighted code.

Does MailBots work with magic links as well as codes?

Yes. The whole message is available, so you can open a magic link from it. Code detection is a convenience on top of the full message.

Can parallel tests share one inbox?

With a catch-all subdomain, each test uses its own address, so parallel tests never read each other's codes even though the mail lands in the same mailbox.