Using MailFlat with Postman
Chain three requests — create an inbox, trigger your flow, read the code — with the address carried between them in a collection variable.
How it fits together
No SDK involved: MailFlat is a plain REST API, so Postman drives it directly. The only trick worth knowing is polling, which a small test script handles with setNextRequest.
Create the inbox
POST to /inboxes, then store the address for the requests that follow.
// Tests tab of "Create inbox"
const body = pm.response.json();
pm.collectionVariables.set("address", body.address);
pm.test("inbox created", () => pm.response.to.have.status(200));
Poll for the code
setNextRequest loops back onto this same request until otp_code shows up.
// Tests tab of "Get latest" → GET {{baseUrl}}/inboxes/{{address}}/latest
const otp = pm.response.json()?.email?.otp_code;
const tries = Number(pm.collectionVariables.get("tries") || 0);
if (otp) {
pm.collectionVariables.set("otp", otp);
pm.collectionVariables.unset("tries");
} else if (tries < 20) {
pm.collectionVariables.set("tries", tries + 1);
setTimeout(() => {}, 3000);
postman.setNextRequest("Get latest"); // poll again
} else {
pm.expect.fail("no OTP arrived in time");
}
Environment
Two variables and the auth header, set once on the collection.
{
"baseUrl": "https://mailflat.net/api/v1",
"apiKey": "mf_live_..."
}
Add X-API-Key: {{apiKey}} as a collection-level header so every request inherits it.
Clean up
A last request in the collection deletes the inbox. Give it retention_hours on create as well, so an aborted run still cleans itself up.
// "Delete inbox" → DELETE {{baseUrl}}/inboxes/{{address}}
// Tests tab:
pm.test("inbox removed", () => pm.response.to.have.status(200));
pm.collectionVariables.unset("address");
pm.collectionVariables.unset("otp");
Worth knowing
Store the key as a Postman secret variable, not in the collection JSON you commit.
The same collection runs headless in CI with newman.
See also
curl
Every endpoint in one terminal. Useful for smoke checks, CI shell steps, and for seeing exactly what your language client sends.
Agent API & MCPThe /api/v1 REST API for automation and AI agents: create inboxes, poll for one-time codes, send mail, plus the MCP server tools.
API Keys & AuthAccount keys versus session tokens: which endpoints accept which credential, how to create and rotate keys, and why the wrong pair returns 401.