Skip to main content
  • Call the API from a trusted backend, not public browser code.
  • Never log API keys, authorization headers, message bodies, HTML, raw MIME, or attachment bytes.
  • Escape all mail metadata before inserting it into HTML, SQL, shell commands, logs, or templates.
  • Render sanitized email HTML in an isolated, sandboxed context with a restrictive Content Security Policy.
  • Scan downloaded files when your risk model requires it; a safe filename and content type do not make an attachment trustworthy.
  • Use separate keys per workload, least-privilege scopes, and immediate revocation on suspected exposure.
  • Bound your own polling interval and deadline; uncontrolled loops waste allowance and can trigger abuse controls.
Temp Mail Lab validates ownership on every resource read, stores key HMACs rather than raw keys, keeps objects private, sanitizes HTML, forces attachment downloads, and applies strict MIME and storage limits. Per-message hard limits and rolling inbound safety admission are independent from your paid request allowance; temporary SMTP admission refusal does not consume API usage.
Last modified on August 2, 2026