If you need a temporary email API to mint a disposable inbox from a script, MailTo exposes a small HTTP interface on mailto.site. The same product still works in the browser: open the temporary email homepage, copy an address, and read mail on that page. The API is for operators and integrators who already hold the site key — not a self-serve developer marketplace.
This public page is a summary of what is live today. After you log in, you can read the full API documentation in the user dashboard: every registered route, JSON examples, the web token link, and the message routes that currently return 404. Guests who open that dashboard link are sent to login, then back to the full doc.
Inboxes last about 30 minutes. Anyone who knows the address can open that mailbox. MailTo is operated by Secuno LLC. There is no SOC 2, ISO, or HIPAA program, and no encryption claim for stored mail.
What you can automate
A caller who has the site API key can list approved domains, create a random disposable address, replace that address with a chosen username and domain, and delete an inbox. Those four actions are implemented and return JSON. They follow the same mailbox rules as the homepage.
Login and register do not issue a personal key. A free account can keep history and favorites. The operator stores one key under Admin → Settings → API and can disable the interface with enable_api.
This page never prints the live site key.
Working endpoints (summary)
GET api/domains/{apiKey}/{type}— type must befree,premium, orallPOST api/emails/{apiKey}— create a random inbox (same lifetime as the homepage)POST api/emails/{apiKey}/{email}/{username}/{domain}— change the addressPOST api/emails/{apiKey}/{email}— delete the inbox
Wrong key: HTTP 401. API turned off: HTTP 403. Message list, message read, message delete, and API attachment download are registered but return HTTP 404 on this site. Read mail in the browser inbox.
The working token deep link is GET /go-to-email/{token}, not /token/{token}.
How to read the full API documentation
- Need one address right now? Use the homepage generator. No key, no signup.
- Want the complete reference? Log in and open API documentation.
- Operating this instance? Enable the API and copy the site key from Admin → Settings → API. Do not paste that key on a public page.
FAQ
Is there a public temporary email API on MailTo?
Yes, when the operator turns it on. It uses one site API key in the URL path. After you log in, you can read the full API documentation. Guest and free accounts do not receive a personal key.
What can the API do today?
It can list approved domains, create a random disposable inbox, change that inbox, and delete an inbox. Those four calls are implemented in the live controller.
Can I fetch messages through the API?
Not on this deployment. Those routes abort 404. The logged-in full doc lists every stub so you do not build against them by accident.
How long does an API-created inbox last?
The same lifetime as a homepage address — 30 minutes by default. Anyone who knows the address can open that inbox while it exists.
Key takeaways
- This public page is a teaser. After login, the user dashboard shows the full API documentation.
- Auth is one operator key in the URL. Accounts do not mint keys.
- Four inbox calls work. Message and API download routes return 404 today.