An agent skill that creates disposable @myslop.app inboxes and waits for mail — verification links, magic links, OTP codes. This is exactly what gets installed — read it before you do.
When your agent hits a sign-up or verification flow that needs a real inbox, this skill tells it how to pick an @myslop.app address, wait for the message with your API token, and pull out the verification link or OTP. Addresses are owned by your account (first to read or claim a name owns it), so mail stays private to you. It only ever calls mail.myslop.app with a token you minted.
Adds this repo as a plugin marketplace, then installs the skill. Updatable with one command later.
Drop the file into your skills directory. Works for Claude Code and anything that reads SKILL.md files.
Or just paste this to any capable agent:
First use will prompt you to authenticate — the skill runs curl -fsS https://mail.myslop.app/setup.sh | bash, which opens a page that mints your token. See setup.sh before running it.
---
name: temp-email
description: Create a temporary email address on @myslop.app and wait for messages to arrive at it. Use for sign-up flows, email verification, magic links, and OTP codes when testing services that require a real receiving inbox. Supports claiming stable, memorable addresses so you can sign back into the same account later.
---
# Temp email
Any address `@myslop.app` is a working inbox. Messages are read via the
authenticated API at `https://mail.myslop.app`. Delivered mail is retained for
7 days, then deleted automatically. Addresses you use are owned by your account:
the first account to read or claim a name owns it, and others get `403` — so
your OTPs and magic links stay private.
## Token
Resolve the API token in this order:
1. `$MYSLOP_MAIL_TOKEN` if set
2. The file `${XDG_CONFIG_HOME:-$HOME/.config}/myslop-mail/token`
If neither exists, or a request returns `401 unauthorized` (token revoked), have
the user run this in an interactive terminal, then retry:
```sh
curl -fsS https://mail.myslop.app/setup.sh | bash
```
It opens a page that signs them in and mints a token automatically; they
copy-paste it once and the script persists it. Every request needs
`-H "Authorization: Bearer $MYSLOP_MAIL_TOKEN"`.
```sh
TOKEN="${MYSLOP_MAIL_TOKEN:-$(cat "${XDG_CONFIG_HOME:-$HOME/.config}/myslop-mail/token")}"
```
## Choosing an address
- **Need to log back into the same account later?** Claim a stable, memorable
name (below) and reuse it. Claiming makes it **permanent** — kept until you
release it. The account on the target service is keyed to the email, so the
same address = the same account.
- **One-off / throwaway?** Just pick any local part, e.g.
`tmp-$(openssl rand -hex 4)@myslop.app`, and start reading it — no claim
needed. Your account **leases** it automatically on first read: the lease is
~1 day, slides forward every time you read it or mail arrives, and once it
lapses the address auto-releases and its mail is deleted. So throwaways clean
themselves up — you never have to release them manually.
Request a longer lease with `?lease=<hours>` (up to 168 / 7 days) on any read or
stream, e.g. `.../inbox/<name>?lease=72`.
## Claim a memorable address
Reserve a name so it's recorded as yours and won't be handed out twice. Omit
`name` to get a generated `adjective-noun` name (e.g. `big-donkey`):
```sh
# Generated memorable name:
curl -sS --fail-with-body -X POST -H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" -d '{"note":"staging llev.dev"}' \
https://mail.myslop.app/claim
# Or request a specific one (201 if granted, 409 if taken by another account):
curl -sS --fail-with-body -X POST -H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" -d '{"name":"big-donkey","note":"staging llev.dev"}' \
https://mail.myslop.app/claim
```
Response includes `address` (e.g. `big-donkey@myslop.app`) — use that in the
sign-up form.
- List your claims: `GET https://mail.myslop.app/claims`
- Release one: `DELETE https://mail.myslop.app/claim/<name>` (also deletes its stored mail)
## Wait for a message
**Preferred — stream (push):** open an SSE stream and mail is pushed the instant
it lands. `curl -N` blocks and prints one `data:` line per message (each is the
**full** message, including `text` and `links` — no second request needed). On
connect it first replays any mail already in the inbox, then streams new
arrivals. Connect *before* triggering the sign-up email so nothing is missed.
```sh
curl -N -H "Authorization: Bearer $TOKEN" \
"https://mail.myslop.app/inbox/<local-part>/stream"
# each event: `data: {"id","from","subject","text","html","links",...}`
```
Read until you see the message you want (match on `subject`/`from`), grab its
link or OTP, then disconnect. Reconnect if the stream drops.
**Fallback — long-poll:** for clients that can't stream, list the inbox with
`wait` (long-polls up to 50s, returns as soon as a message arrives):
```sh
curl -sS --fail-with-body -H "Authorization: Bearer $TOKEN" \
"https://mail.myslop.app/inbox/<local-part>?wait=50"
```
Response: `{"inbox": "...", "messages": [{"id", "from", "subject", "receivedAt"}]}`.
If still empty after a timeout, repeat in a loop as the sign-up flow completes.
## Read a message
```sh
curl -sS --fail-with-body -H "Authorization: Bearer $TOKEN" \
"https://mail.myslop.app/inbox/<local-part>/<id>"
```
Returns the full message: `from`, `subject`, `text`, `html`, and `links` — a
pre-extracted array of all URLs in the body, usually the fastest way to grab a
verification/magic link. For OTP codes, grep the `text` field.
## Clean up (optional)
- Purge an inbox's mail but keep the name: `DELETE https://mail.myslop.app/inbox/<local-part>`.
- Release the name and delete its mail: `DELETE https://mail.myslop.app/claim/<local-part>`.
Manage addresses and tokens any time at https://mail.myslop.app/dashboard.