# testmagic.link — disposable inbox for testing magic-link emails

No signup, no token. Make up a tag: 12-64 hex chars, dashes allowed inside
(a UUID v4 works) — or use this fresh one generated for you:

  Address: d4785c79218af1df@testmagic.link
  Inbox:   https://testmagic.link/inbox/d4785c79218af1df

Flow:
1. Send a sign-in email from the app under test to the address above.
2. GET the inbox URL (poll every few seconds). JSON: {"messages":[{id, from,
   subject, received_at, magic_link, otp_codes}]}. magic_link is the first
   verification link extracted from the email.
3. Open magic_link to complete the flow you are testing.

Optional scanner simulation: add ?prefetch=1 to the inbox URL and this
service GETs each message's magic_link once first (like Outlook SafeLinks
or a corporate mail scanner would; redirects not followed) and reports the
result as prefetch_status on each message. Then open magic_link yourself:
if sign-in still completes, the flow survives link-prefetching scanners;
if it now says the link expired, the app consumes the token on GET — fix
by confirming sign-in via POST on an interstitial page.

Notes: inbox is public (anyone who knows the tag can read it); messages are
deleted after 10 minutes; max 5 messages returned, newest first; rate limit
60 requests/min per IP.

Example task:
Test the magic-link sign-in of <your app URL>: register with the email d4785c79218af1df@testmagic.link, then poll https://testmagic.link/inbox/d4785c79218af1df every 3 seconds (up to 2 minutes) until a message appears, open its magic_link, and confirm you end up signed in.