Catch staging emails

The problem

Staging and development environments often send emails to real addresses. A misconfigured test can spam customers with password resets, send duplicate invoices or leak confidential data to unintended recipients.

How ammo.tools solves it

Point your staging SMTP configuration at ammo.tools. Every email is captured and stored for inspection but never delivered to the addressed recipients. Developers and testers can see what the application sent without any messages reaching the outside world.

Setup

1. Create a project in ammo.tools and note the inbox credentials from the SMTP settings page.
2. Configure your staging environment to use these SMTP settings:

   SMTP Host: smtp.ammo.tools
   Port: 587 (STARTTLS)

3. Set the SMTP username and password from your inbox credentials.
4. Send a test email from your application. It appears in the inbox within seconds.

Environment variables example

EMAIL_HOST=smtp.ammo.tools
EMAIL_PORT=587
EMAIL_USE_TLS=true
EMAIL_HOST_USER=your-inbox-username
EMAIL_HOST_PASSWORD=your-smtp-password

Verify with curl and the API

curl -H "Authorization: Bearer $AMMO_TOOLS_API_KEY" \
  "https://app.ammo.tools/api/v1/inboxes"

Returns your inboxes with SMTP credentials. After sending, list captured messages:

curl -H "Authorization: Bearer $AMMO_TOOLS_API_KEY" \
  "https://app.ammo.tools/api/v1/inboxes/INB_ID/messages"

Things to know

• Captured emails are retained according to your plan. Check pricing for retention periods.
• Emails are never forwarded to their addressed recipients. This is intentional.
• Each inbox has a unique SMTP username. Use separate inboxes for different environments to keep captures organised.
• Captured content is stored in the EU. See the data processing agreement for details.

Related guides

• Test password reset emails

  Verify password reset flows in automated tests. Capture reset emails and extract tokens through the API.

• Test webhooks locally

  Forward captured webhooks to your local development server. Debug payment, notification and integration webhooks.

• Fetch verification codes in tests

  Extract OTP and verification codes from captured emails using the API. Automate MFA and confirmation flows in your test suite.

• Email testing for code agents

  Let AI coding agents verify email sending. Read captured messages through MCP tools without browser access.

• Preview HTML emails on mobile

  Share captured emails with designers and testers. Preview HTML rendering on any device without sending to real addresses.

• Check emails for spam content

  Scan captured emails for spam triggers before production. Identify deliverability issues with automated content analysis.

• Simulate SMTP failures

  Test how your application handles SMTP errors. Simulate temporary and permanent delivery failures for resilience testing.