In this tutorial I'll show you a complete, copy-paste Playwright setup that:

1. Generates a disposable inbox via API (no signup, no key)
2. Runs your signup form with that address
3. Polls the inbox, extracts the OTP/verification link
4. Completes the flow and asserts success

I'll use the 1sec.email API because it's free, needs no API key, and the endpoints are dead simple. The patterns transfer to any temp-mail API (mail.tm, Guerrilla Mail, etc.).

Why Temp Mail APIs Beat Real Mailboxes in E2E Tests

The trade-off: disposable APIs give you receive-only inboxes with short lifetimes. That's exactly what signup/OTP tests need — and nothing they don't.

The 1sec.email API: Two Endpoints

The whole API surface you need:

# 1. Check the inbox for an address (creates it implicitly on first use)
GET https://1sec.email/api/emails?address=mytest123@1sec.email

# Response: JSON array of message summaries
[
  {
    "id": 892131,
    "from": "noreply@example-app.com",
    "subject": "Verify your email",
    "date": "2026-09-30 09:12:44",
    "bodyPreview": "Your code is 482913..."
  }
]

# 2. Fetch a full message by ID
GET https://1sec.email/api/emails/892131

# Response: full message with HTML/text body

That's it. Any address on the service's domains works — there's no registration step, so your test can generate a unique address per run (e.g. e2e-${Date.now()}@1sec.email) and never worry about collisions.

The Full Playwright Test

Here's a complete working test. It signs up a user on a fictional app, waits for the OTP email, extracts the 6-digit code, and completes verification:

// tests/signup.spec.ts
import { test, expect } from '@playwright/test';

const MAIL_API = 'https://1sec.email/api';

interface MailSummary {
  id: number;
  from: string;
  subject: string;
  date: string;
  bodyPreview: string;
}

/** Generate a unique disposable address for this test run */
function freshAddress(): string {
  const stamp = Date.now().toString(36);
  const rand = Math.random().toString(36).slice(2, 8);
  return `e2e-${stamp}-${rand}@1sec.email`;
}

/** Poll the inbox until a message arrives (or time out) */
async function waitForEmail(
  address: string,
  opts: { timeoutMs?: number; intervalMs?: number } = {}
): Promise<MailSummary> {
  const timeoutMs = opts.timeoutMs ?? 90_000;
  const intervalMs = opts.intervalMs ?? 3_000;
  const deadline = Date.now() + timeoutMs;

  while (Date.now() < deadline) {
    const res = await fetch(
      `${MAIL_API}/emails?address=${encodeURIComponent(address)}`
    );
    if (!res.ok) throw new Error(`Mail API error: ${res.status}`);
    const messages: MailSummary[] = await res.json();

    if (messages.length > 0) {
      // Newest first — take the latest message
      return messages.sort((a, b) => b.id - a.id)[0];
    }
    await new Promise((r) => setTimeout(r, intervalMs));
  }
  throw new Error(`Timed out waiting for email to ${address}`);
}

/** Fetch the full body of a message */
async function getMessageBody(id: number): Promise<string> {
  const res = await fetch(`${MAIL_API}/emails/${id}`);
  if (!res.ok) throw new Error(`Mail API error: ${res.status}`);
  const msg = await res.json();
  return msg.body ?? msg.textBody ?? '';
}

test('user can sign up and verify email via OTP', async ({ page }) => {
  const email = freshAddress();
  const password = 'TestPass123!';

  // 1. Fill the signup form with the disposable address
  await page.goto('https://your-app.example.com/signup');
  await page.getByLabel('Email').fill(email);
  await page.getByLabel('Password').fill(password);
  await page.getByRole('button', { name: /sign up/i }).click();

  // 2. App should now show "check your inbox"
  await expect(page.getByText(/check your inbox/i)).toBeVisible();

  // 3. Poll the disposable inbox for the OTP email
  const message = await waitForEmail(email);

  // 4. Extract the 6-digit code from the full body
  const body = await getMessageBody(message.id);
  const match = body.match(/\b(\d{6})\b/);
  expect(match, 'OTP code not found in email body').not.toBeNull();
  const otp = match![1];

  // 5. Enter the code and complete verification
  await page.getByLabel(/verification code/i).fill(otp);
  await page.getByRole('button', { name: /verify/i }).click();

  // 6. Assert we're in
  await expect(page.getByText(/welcome/i)).toBeVisible({ timeout: 15_000 });
});

Why This Polling Pattern Doesn't Flake

Three details make the difference between a reliable test and a flaky one:

1. Unique address per run. Reusing one inbox across tests means leftover messages from previous runs get picked up. Date.now() + random suffix makes collisions effectively impossible.
2. Sort by ID descending. Take the newest message, not the first. If your app sends a welcome email and an OTP, you want the OTP.
3. Regex on the full body, not the preview. bodyPreview is truncated — the code might be cut off. Always fetch the full message before extracting.

Extracting Verification Links Instead of Codes

If your app sends a magic link instead of an OTP, swap the extraction step:

const body = await getMessageBody(message.id);
const linkMatch = body.match(/https?:\/\/[^\s"'<>]+verify[^\s"'<>]*/i);
expect(linkMatch, 'Verification link not found').not.toBeNull();

// Visit the link directly — no need to click through the UI
await page.goto(linkMatch![0]);
await expect(page.getByText(/verified/i)).toBeVisible({ timeout: 15_000 });

Visiting the link directly with page.goto is faster and less flaky than trying to click a link inside a rendered email.

Cypress Variant

Same idea, Cypress style — put the polling in a custom command:

// cypress/support/commands.js
Cypress.Commands.add('getOtpEmail', (address, timeout = 90000) => {
  const started = Date.now();
  const poll = () => {
    return cy
      .request(`https://1sec.email/api/emails?address=${address}`)
      .then((res) => {
        if (res.body.length > 0) return res.body[0];
        if (Date.now() - started > timeout) {
          throw new Error(`No email arrived for ${address}`);
        }
        return cy.wait(3000).then(poll);
      });
  };
  return poll();
});

// cypress/e2e/signup.cy.js
it('signs up with OTP verification', () => {
  const email = `cypress-${Date.now()}@1sec.email`;
  cy.visit('/signup');
  cy.get('[data-cy=email]').type(email);
  cy.get('[data-cy=password]').type('TestPass123!');
  cy.get('[data-cy=submit]').click();

  cy.getOtpEmail(email).then((msg) =>
    cy.request(`https://1sec.email/api/emails/${msg.id}`)
  ).then((res) => {
    const code = res.body.body.match(/\b(\d{6})\b/)[1];
    cy.get('[data-cy=otp]').type(code);
    cy.get('[data-cy=verify]').click();
  });

  cy.contains(/welcome/i).should('be.visible');
});

Python Version (for Selenium / API-Level Tests)

import re, time, requests
from datetime import datetime

MAIL_API = "https://1sec.email/api"

def fresh_address() -> str:
    stamp = datetime.now().strftime("%Y%m%d%H%M%S%f")
    return f"pytest-{stamp}@1sec.email"

def wait_for_email(address: str, timeout: int = 90) -> dict:
    deadline = time.time() + timeout
    while time.time() < deadline:
        r = requests.get(f"{MAIL_API}/emails", params={"address": address})
        r.raise_for_status()
        msgs = r.json()
        if msgs:
            return max(msgs, key=lambda m: m["id"])
        time.sleep(3)
    raise TimeoutError(f"No email arrived for {address}")

def get_otp(address: str) -> str:
    msg = wait_for_email(address)
    full = requests.get(f"{MAIL_API}/emails/{msg['id']}").json()
    body = full.get("body") or full.get("textBody") or ""
    m = re.search(r"\b(\d{6})\b", body)
    assert m, "OTP not found in email body"
    return m.group(1)

CI Considerations

A few things to get right when this runs in CI:

• Parallel runs: unique addresses per test (shown above) mean parallel workers never collide. Don't share one inbox across workers.
• Rate limits: keep the poll interval at 3+ seconds. Polling every 500ms from 10 parallel workers looks like abuse and can get your CI IPs throttled.
• Timeouts: 90 seconds is generous; most OTPs arrive in 5–20 seconds. In CI, allow more headroom than locally — mail queues are slower under load.
• Cleanup: disposable inboxes auto-expire, so there's nothing to delete. One less teardown step than Mailtrap-style inboxes.
• Don't test the email provider. Your test asserts your app's behavior. If the temp-mail API is down, that's an infrastructure blip, not an app bug — consider a retry or a fallback provider for the mail step so provider outages don't red your builds.

When NOT to Use This

• Testing actual email deliverability (SPF/DKIM, spam scores, inbox placement) — use a real seed-list service.
• Load testing your mail pipeline — hammering a free API is rude and will get you blocked. Use a local fake SMTP (MailHog) for volume.
• Long-lived test accounts — disposable inboxes expire. For accounts your suite revisits over days, use a real mailbox or a persistent test-mail service.

For the 90% case — "my E2E test needs to read one OTP email" — a free disposable email API is the fastest path from zero to green. Grab an address from 1sec.email, poll the API, extract the code, and move on to testing the things that actually matter.

Related reading: Temp Mail Not Receiving Emails? 9 Fixes That Actually Work · Why Do Websites Block Temp Mail?

How it works: invent any address like qa-test-42@1sec.email, point your app's signup form at it, then poll GET https://1sec.email/api/emails?address=qa-test-42@1sec.email — the inbox exists the instant you query it. No registration, no API keys, no "create mailbox" step.

A minimal Node.js polling loop:

async function waitForMail(address, tries = 30) {
  for (let i = 0; i < tries; i++) {
    const res = await fetch(`https://1sec.email/api/emails?address=${address}`).then(r => r.json());
    if (res.emails && res.emails.length) return res.emails[0];
    await new Promise(r => setTimeout(r, 2000));
  }
  throw new Error("mail never arrived");
}

Why I like it for test suites: unique addresses per run eliminate cross-talk between parallel CI jobs; you're exercising the real SMTP path, not a mock; and the zero-disk design means test mail simply vanishes instead of piling up somewhere.

Try it in your browser first: https://1sec.email/ — open the page and the inbox is already there.