Dokumentasi API

Ringkasan

Tempmail berbasis 106 domain milik sendiri (my.id / web.id / biz.id), inbox di edge Cloudflare. Email dihapus otomatis 24 jam setelah diterima. Semua response JSON kecuali /mail/api/raw (.eml).

Akses lewat web (UI) bebas tanpa key — cukup buka halaman utama. Untuk API dari luar (bot/script), wajib header X-API-Key — tanpa key → 401 unauthorized. Bisa juga Authorization: Bearer <key> atau param ?key=.

API Key

Buat akses API dari luar (bot/script). Pengguna web biasa tidak butuh ini — cukup pakai UI. Key dibuat oleh admin; bagikan per-bot/per-orang; bisa di-revoke kapan pun.

Buat key (admin):

curl -X POST "$BASE/mail/api/keys" \
  -H "X-Admin-Key: <ADMIN_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"name":"bot-verif-1"}'
# → {"ok":true,"key":"kong_xxx...","name":"bot-verif-1"}

List semua key:

curl "$BASE/mail/api/keys" -H "X-Admin-Key: <ADMIN_KEY>"

Revoke key:

curl -X DELETE "$BASE/mail/api/keys" \
  -H "X-Admin-Key: <ADMIN_KEY>" -H "Content-Type: application/json" \
  -d '{"key":"kong_ydd_ff_revoke"}'

Endpoint

Endpoint	Deskripsi
`GET /mail/api/domains`	Array semua domain aktif.
`POST /mail/api/new?domain=&sld=`	Generate alamat. sld opsional — kalau dikirim, pakai custom nama (lowercase, alnum + hubung, 2-63 char); kalau kosong/random.
`GET /mail/api/inbox?addr=..`	List pesan (id, from_addr, subject, received_at, otp, attachments).
`GET /mail/api/otp?addr=..`	OTP terakhir (auto-extract digit/alfanumerik dari body+subject).
`GET /mail/api/msg?id=..`	Detail pesan: text, html, attachments, otp.
`GET /mail/api/raw?id=..`	Unduh .eml mentah RFC822 (attachment).
`DELETE /mail/api/delete?addr=..`	Hapus semua email alamat.
`GET /mail/api/send-test?to=..`	Kirim email test internal (butuh destination verified di CF).

cURL (pakai X-API-Key)

BASE="https://kongmedia.web.id"
KEY="kong_xxx"

# daftar domain
curl "$BASE/mail/api/domains" -H "X-API-Key: $KEY"

# alamat dengan custom nama
curl "$BASE/mail/api/new?domain=kongmedia.web.id&sld=kongtest&key=$KEY"

# poll inbox
curl "$BASE/mail/api/inbox?addr=kongtest@kongmedia.web.id" -H "X-API-Key: $KEY"

# ambil OTP terakhir
curl "$BASE/mail/api/otp?addr=kongtest@kongmedia.web.id" -H "X-API-Key: $KEY"

Bot Verifikasi Massal (Python)

import requests, time

B = "https://kongmedia.web.id"
KEY = "kong_xxx"                 # dari admin
HED = {"X-API-Key": KEY}

def buat_algo():
    d = requests.get(f"{B}/mail/api/domains", headers=HED).json()[0]
    sld = "kong" + str(int(time.time()))[-6:]
    return requests.get(f"{B}/mail/api/new",
        params={"domain": d, "sld": sld}, headers=HED).json()["addr"]

def tunggu_otp(addr, timeout=120):
    end = time.time() + timeout
    while time.time() < end:
        r = requests.get(f"{B}/mail/api/otp",
            params={"addr": addr}, headers=HED, timeout=15).json()
        if r.get("otp"):
            return r["otp"]
        time.sleep(4)

addr = buat_algo()
print("alamat:", addr)
otp = tunggu_otp(addr)          # togel ke situs target pakai addr, lalu...
print("OTP:", otp)              # kode masuk otomatis di sini

Catatan

Custom sld divalidasi server: ^[a-z0-9]( ... )$ 2-63 char; invalid → 400.
Email lama gak bisa di-recovery setelah 24 jam (auto-purge).
Attachment disimpan sebagai nama file saja (max 12). Funding raw .eml via /raw.
Domain dapat ditambah kapan pun (zone CF + catch-all worker) — UI lags tak perlu update.