PNTR
All guides

Testing guide

Test email OTP codes with a disposable inbox API

Email OTP tests become unreliable when parallel runs share one address or select whichever message arrived last. A catch-all PNTR inbox lets the test isolate delivery by exact recipient before it reads or submits the code.

Explore PNTR's disposable email for developers
Create the OTP test inbox
OTP extraction after matching the email/TypeScript
import { extractOtp } from "@pntr/testkit";// `message` is returned by pntr.waitForEmail(hostname, options).const otp = extractOtp(  message,  /Verification code:\s*(\d{6})/);

Setup

  1. 1

    Create an email-enabled test hostname

    Enable email on a PNTR subdomain and generate an API token. Use a dedicated non-production inbox so test messages never mix with real customer mail.

  2. 2

    Record the test boundary

    Save the current timestamp, then generate a unique address such as [email protected]. Submit that address to your application's OTP request form.

  3. 3

    Wait for the exact recipient

    Call TestKit's waitForEmail with the full hostname, exact recipient, and test start time. Subject filtering can provide an additional check but should not be the only identifier.

  4. 4

    Read and parse the message

    waitForEmail returns the complete matched message. Pass it to extractOtp with the format your application owns, and avoid a broad digit search if prices, dates, or support numbers can also appear in the template.

  5. 5

    Assert the complete OTP lifecycle

    Submit the code through the application, verify success, then assert that reuse or expiry behaves according to your product's policy. PNTR verifies delivery, not the security behavior of your OTP implementation.

Before you ship

The regular expression is an example for a template containing “Verification code: 123456.” Match your own stable label and code length, and never use captured production OTPs or credentials in a shared test environment.

Primary documentation