Getting started
Authentication
No account, password, or API key. Keep a private cookie jar for each independent client.
How authentication works
POST /mailboxes returns a random address and a mailbox-scoped HttpOnly cookie. POST /mailboxes/{mailbox_id}/select proves possession of that cookie and issues the current-inbox cookie. All later requests must send the cookies back to the same API hostname. Cookies are Secure in production, SameSite=Lax and host-only. The server stores a one-way hash of the random credential. A mailbox ID or address alone grants no access. There is no /token endpoint and no Bearer authentication.
Create, select, and read
Use a recent curl with --fail-with-body and install jq. The complete, copyable quickstart is on the documentation homepage. These commands show the individual steps; replace MAILBOX_ID with data.mailbox.id from the creation response.
umask 077
JAR=$(mktemp)
# 1. Create (address and ID are under data.mailbox)
curl --fail-with-body -sS -c "$JAR" \
-H 'Content-Type: application/json' -d '{}' \
'https://inboxflick.com/v1/mailboxes'
# 2. Select (keep both -b and -c)
curl --fail-with-body -sS -b "$JAR" -c "$JAR" \
-X POST 'https://inboxflick.com/v1/mailboxes/MAILBOX_ID/select'
# 3. Read
curl --fail-with-body -sS -b "$JAR" 'https://inboxflick.com/v1/messages'Lifetime and privacy
An inbox starts with 10 minutes. Extend it before expiry, up to 60 minutes from creation. Check expires_at and max_expires_at in every mailbox response; a cookie expiry does not extend the inbox. Losing the cookie jar, destroying the mailbox, or reaching expiry makes it inaccessible. There is no recovery by email address. Store jars outside source control with restrictive permissions. Never paste Cookie or Set-Cookie headers into logs, tickets, or public repositories.
Client requirements
Use curl, requests.Session in Python, or a Node.js cookie-jar client. Keep the creation and selection cookies together. A separate cookie jar creates a separate security boundary. Do not reuse a website browser session in shared CI jobs. This API is intended for server-side tools and scripts. Cross-origin browser access is not enabled; docs pages do not receive your inbox credentials. No built-in outgoing-mail or SMS endpoint is provided.