PNTR
All guides

Testing guide

Test email OTP codes with a disposable inbox API

Email OTP tests become unreliable when parallel runs share one address or select whichever message arrived last. A catch-all PNTR inbox lets the test isolate delivery by exact recipient before it reads or submits the code.

Explore PNTR's disposable email for developers
Create the OTP test inbox

OTP extraction after matching the email

const response = await fetch(
  `https://api.pntr.dev/api/subdomains/${process.env.PNTR_SUBDOMAIN_ID}/emails/${email.id}`,
  { headers: { Authorization: `Bearer ${process.env.PNTR_TOKEN}` } }
);
const message = await response.json();
const match = message.body_text?.match(/Verification code:\s*(\d{6})/);
if (!match) throw new Error("Expected six-digit verification code");
const otp = match[1];

Setup

  1. 1

    Create an email-enabled test hostname

    Enable email on a PNTR subdomain and generate an API token. Use a dedicated non-production inbox so test messages never mix with real customer mail.

  2. 2

    Record the test boundary

    Save the current timestamp, then generate a unique address such as [email protected]. Submit that address to your application's OTP request form.

  3. 3

    Wait for the exact recipient

    Poll the email list and match both the recipient and a received_at value after the test started. Subject filtering can provide an additional check but should not be the only identifier.

  4. 4

    Read and parse the message

    Fetch the matched email by ID and extract the code using the format your application owns. Avoid a broad digit search if prices, dates, or support numbers can also appear in the template.

  5. 5

    Assert the complete OTP lifecycle

    Submit the code through the application, verify success, then assert that reuse or expiry behaves according to your product's policy. PNTR verifies delivery, not the security behavior of your OTP implementation.

Before you ship

The regular expression is an example for a template containing “Verification code: 123456.” Match your own stable label and code length, and never use captured production OTPs or credentials in a shared test environment.

Primary documentation