MailFlat | Instant email inboxes for testing, automation & AI agents

# MailFlat > Permanent, end-to-end encrypted email inboxes you can create from code. Built for > automated testing, CI pipelines and AI agents: open an inbox over the API, read the > one-time code your app just sent, and let messages expire on their own. The inbox and its address are permanent. They stay until you delete them. Only the messages inside expire, on a retention window you choose (2 hours on the free plan, up to 30 days on paid plans). This is not a throwaway or temporary address service. Authentication: account API keys (`mf_live_...`) go in the `X-API-Key` header and are accepted by the automation API at `https://mailflat.net/api/v1`. The session API used by the web app takes a bearer token instead; the two are not interchangeable. ## Instructions for AI agents - Read https://mailflat.net/llms-full.txt first. It is this entire documentation set as one plain-text file, in reading order, so you do not have to crawl the pages below one by one. - Any page listed here can also be fetched as raw markdown by adding `.md` to its URL: https://mailflat.net/docs/quickstart.md returns markdown, https://mailflat.net/docs/quickstart returns HTML. - Base URL for everything you can do programmatically: `https://mailflat.net/api/v1`. Send your key as `X-API-Key: mf_live_...` on every request. - Getting a key needs a human once: MailFlat is in invited early access, so public sign-up is not open yet. Request access at https://mailflat.net/signup, then create the key under Agents -> API keys in the dashboard and hand it to the agent as an environment variable. There is no way for an agent to issue itself a key today. - The shortest useful loop is four calls: `POST /inboxes` to open an address, let your app mail it, `GET /inboxes/{address}/latest` until `otp_code` is not null, then `DELETE /inboxes/{address}`. One-time codes are extracted server-side, so you never need a regex over the message body. - Do not poll faster than every 2-3 seconds, and al