Developer Documentation

EvilMail API Reference

Integrate disposable email, custom domains, inbox reading, DNS management, and smart verification code extraction into your applications.

Base URL:https://evilmail.pro

Format:JSON

Auth:API Key / Session

Protocols:HTTPS only

Overview

The EvilMail API provides programmatic access to all platform features. Create disposable emails, manage custom domains, read inboxes, extract verification codes, and control DNS records — all through a simple RESTful interface.

Temporary Email API

Create disposable inboxes, read messages, auto-expire

Domain & Email API

Custom domains, email accounts, DNS management

Regex Extraction

Auto-extract verification codes from 8+ services

Official SDK Libraries

Node.js

npm install evilmail

npmjs.com/package/evilmail

Python

pip install evilmail

pypi.org/project/evilmail

PHP

composer require evilmail/evilmail-php

packagist.org

go get github.com/Evil-Mail/evilmail-go

pkg.go.dev

Response Format

All responses follow a consistent JSON structure:

{
  "status": "success" | "error",
  "message": "Human-readable message (optional)",
  "messageKey": "i18n key for localized errors (optional)",
  "data": { ... }
}

Error responses include messageKey for localized error messages matching the user's account language.

Authentication

EvilMail uses two authentication methods depending on the endpoint type. All API requests must be made over HTTPS.

API Key

For temp email creation and verification code extraction. Requires an active paid subscription.

X-API-Key: your_64char_hex_key

Session Cookie

For domain, email account, and DNS management endpoints. Set after login.

Cookie: evilmail_session=...

Temporary Email API requires a paid plan

The temp email API and regex extraction endpoints require an active Bronze, Gold, or Premium subscription. Free accounts can only use the web interface.

Temporary Email

Paid Plan Required

Create disposable email addresses with configurable TTL. Available domains: evilmail.pro, evilmail.cloud.

Create a temporary email address

Request Body

domainstringoptionalDomain to use (default: evilmail.pro)

ttlMinutesnumberoptionalLifetime: 10, 30, 60, 360, 1440 (default: 60)

Response

{
  "status": "success",
  "data": {
    "email": "[email protected]",
    "domain": "evilmail.pro",
    "sessionToken": "a1b2c3d4...",
    "ttlMinutes": 60,
    "expiresAt": "2026-03-07T15:30:00.000Z"
  }
}

Available domains: evilmail.pro, evilmail.cloud. Requires an active paid subscription.

Inbox & Messages

Read incoming emails from your temporary inbox or your own email accounts on custom domains. Temp inbox uses session cookies, custom domain accounts use API key authentication.

Domain Management

Email Accounts

Create, list, and manage email accounts under your verified domains. Supports single and batch creation with random username generation.

Smart Verification Code Extraction

API Key

Automatically extract verification codes from incoming emails. Perfect for automated testing, account registration flows, and CI/CD pipelines.

Extract verification code from the latest email

Parameters

servicestringrequiredService name (see supported list)

emailstringrequiredEmail address to search (query param)

Response

{
  "status": "success",
  "data": {
    "code": "847291",
    "service": "google",
    "email": "[email protected]",
    "from": "[email protected]",
    "subject": "Your verification code",
    "date": "2026-03-07T14:22:00.000Z"
  }
}

Searches the last 20 messages. You must own the domain.

Supported Services

Service	Endpoint	Code Pattern	Sender Domains
Google	/api/regex/google	G-XXXXXX	google.com, accounts.google.com
Facebook	/api/regex/facebook	XXXXXX	facebookmail.com, facebook.com
Twitter/X	/api/regex/twitter	XXXXXXXX	twitter.com, x.com
Instagram	/api/regex/instagram	XXXXXX	instagram.com, mail.instagram.com
TikTok	/api/regex/tiktok	XXXX-XXXXXX	tiktok.com
Discord	/api/regex/discord	XXXXXX	discord.com
LinkedIn	/api/regex/linkedin	XXXXXX	linkedin.com
iCloud	/api/regex/icloud	XXXXXX	apple.com, id.apple.com

Need a Different Service?

If the service you're looking for isn't listed above, let us know. We regularly expand our supported integrations based on developer feedback and can add new regex patterns for any email-based verification service.

api-example

# Extract Google verification code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

# Extract Discord verification code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

# Extract TikTok code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

DNS Management

Full DNS record management via PowerDNS. Supports A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA record types. Records propagate via 4 geographically distributed nameservers.

Code Examples

Complete working examples for creating temp emails, reading inboxes, and extracting verification codes.

Temporary Email Flow

api-example

# Create a temporary email
curl -X POST https://evilmail.pro/api/temp-email \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"domain": "evilmail.pro", "ttlMinutes": 60}'

# Response: { "data": { "email": "...", "sessionToken": "abc123..." } }

# Poll for incoming messages using the session token
curl https://evilmail.pro/api/temp-email/abc123...

# Response includes messages array
# { "data": { "email": "...", "messages": [...] } }

Verification Code Extraction

api-example

# Extract Google verification code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

# Extract Discord verification code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

# Extract TikTok code
curl "https://evilmail.pro/api/regex/[email protected]" \
  -H "X-API-Key: YOUR_API_KEY"

Domain Management Examples

api-example

# Add a domain
curl -X POST https://evilmail.pro/api/domains \
  -H "Content-Type: application/json" \
  -H "Cookie: evilmail_session=YOUR_SESSION" \
  -d '{"domain": "mydomain.com"}'

# List domains
curl https://evilmail.pro/api/domains \
  -H "Cookie: evilmail_session=YOUR_SESSION"

# Verify DNS
curl -X POST https://evilmail.pro/api/domains/check \
  -H "Content-Type: application/json" \
  -H "Cookie: evilmail_session=YOUR_SESSION" \
  -d '{"domain": "mydomain.com"}'

# Create email account
curl -X POST https://evilmail.pro/api/accounts \
  -H "Content-Type: application/json" \
  -H "Cookie: evilmail_session=YOUR_SESSION" \
  -d '{"email": "[email protected]", "password": "secure123"}'

Rate Limits & Plans

Plan Limits

Feature	Free	Bronze	Gold	Premium
Custom Domains	1	5	25	999
Emails / Domain	5	999	999	999
Temp Email API	Web only	Full	Full	Full
Regex API	Web only	Full	Full	Full
API Rate Limit	100/hr	1,000/hr	5,000/hr	Unlimited
Temp Sessions / IP	10	10	10	10

Endpoint Rate Limits

Per IP address

POST /api/auth/login10 / 15 min

POST /api/auth/register5 / 1 hour

POST /api/auth/forgot-password3 / 1 hour

POST /api/auth/reset-password5 / 15 min

PUT /api/account/password5 / 15 min

POST /api/contact5 / 1 hour

POST /api/temp-email10 sessions / IP

GET /api/regex/{service}Plan-based

Error Handling

All error responses include a status field set to "error", a human-readable message, and an optional messageKey for localized error messages matching the user's account language.

{
  "status": "error",
  "message": "Domain limit reached. Upgrade your plan for more.",
  "messageKey": "domainLimitReached"
}

Code	Status	Description
200	Success	Request completed successfully
400	Bad Request	Missing or invalid parameters
401	Unauthorized	Invalid or missing authentication
403	Forbidden	Insufficient permissions or plan limits
404	Not Found	Resource does not exist
409	Conflict	Resource already exists (duplicate)
429	Rate Limited	Too many requests, slow down
500	Server Error	Internal server error

Localized Error Messages

Use the messageKey field to display errors in the user's preferred language. Supported: English, Turkish, Russian, Ukrainian, Polish, French, German, Azerbaijani, Persian, Filipino, Hausa, Akan.

API Explorer

Test API endpoints directly from your browser. Enter your API key and send requests to see live responses.

API Explorerv1.0

evilmail.pro

POST

POSThttps://evilmail.pro/api/temp-email

API Key

Request Body

domain

ttlMinutes

Send a request to see the response

Ready to integrate?

Get your API key from the dashboard and start building. Full access with any paid plan.

Get Started Free View Plans

{ "status": "success", "data": { "email": "[email protected]", "domain": "evilmail.pro", "sessionToken": "a1b2c3d4...", "ttlMinutes": 60, "expiresAt": "2026-03-07T15:30:00.000Z" } }

{ "status": "success", "data": { "code": "847291", "service": "google", "email": "[email protected]", "from": "[email protected]", "subject": "Your verification code", "date": "2026-03-07T14:22:00.000Z" } }

Service

Endpoint

Code Pattern

Sender Domains

Google

/api/regex/google

G-XXXXXX

google.com, accounts.google.com

Facebook

/api/regex/facebook

XXXXXX

facebookmail.com, facebook.com

Twitter/X

/api/regex/twitter

XXXXXXXX

twitter.com, x.com

Instagram

/api/regex/instagram

XXXXXX

instagram.com, mail.instagram.com

TikTok

/api/regex/tiktok

XXXX-XXXXXX

tiktok.com

Discord

/api/regex/discord

XXXXXX

discord.com

/api/regex/linkedin

XXXXXX

linkedin.com

iCloud

/api/regex/icloud

XXXXXX

apple.com, id.apple.com

# Extract Google verification code curl "https://evilmail.pro/api/regex/[email protected]" \ -H "X-API-Key: YOUR_API_KEY" # Extract Discord verification code curl "https://evilmail.pro/api/regex/[email protected]" \ -H "X-API-Key: YOUR_API_KEY" # Extract TikTok code curl "https://evilmail.pro/api/regex/[email protected]" \ -H "X-API-Key: YOUR_API_KEY"

# Create a temporary email curl -X POST https://evilmail.pro/api/temp-email \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY" \ -d '{"domain": "evilmail.pro", "ttlMinutes": 60}' # Response: { "data": { "email": "...", "sessionToken": "abc123..." } } # Poll for incoming messages using the session token curl https://evilmail.pro/api/temp-email/abc123... # Response includes messages array # { "data": { "email": "...", "messages": [...] } }

# Add a domain curl -X POST https://evilmail.pro/api/domains \ -H "Content-Type: application/json" \ -H "Cookie: evilmail_session=YOUR_SESSION" \ -d '{"domain": "mydomain.com"}' # List domains curl https://evilmail.pro/api/domains \ -H "Cookie: evilmail_session=YOUR_SESSION" # Verify DNS curl -X POST https://evilmail.pro/api/domains/check \ -H "Content-Type: application/json" \ -H "Cookie: evilmail_session=YOUR_SESSION" \ -d '{"domain": "mydomain.com"}' # Create email account curl -X POST https://evilmail.pro/api/accounts \ -H "Content-Type: application/json" \ -H "Cookie: evilmail_session=YOUR_SESSION" \ -d '{"email": "[email protected]", "password": "secure123"}'

Feature

Free

Bronze

Gold

Premium

Custom Domains

999

Emails / Domain

999

Temp Email API

Web only

Full

Regex API

Web only

Full

API Rate Limit

100/hr

1,000/hr

5,000/hr

Unlimited

Temp Sessions / IP

Code

Status

Description

200

Success

Request completed successfully

400

Bad Request

Missing or invalid parameters

401

Unauthorized

Invalid or missing authentication

403

Forbidden

Insufficient permissions or plan limits

404

Not Found

Resource does not exist

409

Conflict

Resource already exists (duplicate)

429

Rate Limited

Too many requests, slow down

500

Server Error

Internal server error