Extracting one-time codes from email
MailFlat pulls the verification code out of the message for you and hands it over as a field, so your test never runs a regex against an email body.
How it works
Every incoming message is scanned for a one-time code. The result lands in otp_code, and every client exposes it directly. Codes are only accepted when a context word (code, OTP, PIN, verification) sits right next to them, so a stray number in a footer or a year in a copyright line is never mistaken for a code.
Read the code
The waiting helpers return the code itself, so this is usually the whole of it.
otp = inbox.wait_for_otp(timeout=30)
assert otp == "482913"
Read it off a message you already have
If you fetched the message for other assertions, the code is already on it.
msg = inbox.latest()
assert msg.otp is not None, "no code was extracted"
Worth knowing
Encrypted inboxes cannot expose codes
On an end-to-end encrypted inbox the server never sees the body, so otp_code comes back empty and the response carries encrypted: true with a note. Inboxes opened through the API are always plain text for exactly this reason.
See also
Waiting and timeouts
Mail is asynchronous, so every email test waits for something. The difference between a solid suite and a flaky one is how that wait is written.
LinksEvery clickable link in a message is pulled out for you as an ordered, de-duplicated list, so magic-link and password-reset flows are one assertion away.
Message propertiesThe envelope around the body: who sent it, exactly which address it reached, what the subject line said and when it landed.