> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tempmaillab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Treat docs/openapi.yaml as the normative public API contract.
> Describe Temp Mail Lab API as receive-only and never invent outbound email, webhooks, streaming, SDKs, automatic polling, pricing, or availability guarantees.
> Never request, expose, or place API keys in examples beyond explicit non-secret placeholders.

# Rate Limits

> Handle commercial allowance, burst protection, and inbound safety separately.

Temp Mail Lab applies several independent controls:

| Control                      | Purpose                                                   |
| ---------------------------- | --------------------------------------------------------- |
| Billing-period allowance     | Tracks completed authenticated public API operations.     |
| Short-window HTTP protection | Rejects unsafe bursts without consuming allowance.        |
| Email creation limits        | Constrain active reservations and daily creation.         |
| Inbound admission            | Protects mail parsing and storage from untrusted traffic. |
| Content ceilings             | Bound MIME, body, and attachment work.                    |

When a request returns `429`, honor `Retry-After` and use exponential backoff with jitter. Do not open an unbounded retry or polling loop. `RateLimit-Reset` is a UTC Unix timestamp for the authoritative allowance window; it is not permission to ignore short-window protection.

Current rolling five-minute inbound defaults are 20 messages or 50 MiB per email and 100 messages or 250 MiB per account. SMTP can temporarily refuse traffic above these safety ceilings. Such refusal does not consume public API allowance.

Current content ceilings are 10 MiB raw MIME, 128 KiB MIME headers, 30 nesting levels, 256 multipart delimiter lines, 512 KiB each for parsed text and sanitized HTML, 10 attachments, 5 MiB per attachment, and 8 MiB total attachment data.

These operational safety defaults are not pricing promises and can be tuned after isolated evidence.