Capture Your App's Email (SMTP)

Point your app's SMTP settings at Hooklistener in staging, CI or local development, and every email it sends lands in an inbox instead of reaching real people. It works like Mailtrap's sandbox: nothing is ever delivered, whatever the recipients.

Captured emails are ordinary inbox emails. You read them in the dashboard, wait for them from a test with the API, or let an AI agent read the code or link they contain.

Get the credentials

Every inbox has its own SMTP username and password. Find them:

• in the dashboard, under SMTP settings on the inbox page, with ready-to-paste configuration for Nodemailer, Rails, Django, Laravel and Swoosh;
• in the smtp field of GET /api/v1/inboxes/:id and of the MCP tools create_inbox and list_inboxes.

Setting	Value
Host	smtp.hookinbox.com
Port	587
Security	STARTTLS, required before login
Authentication	PLAIN or LOGIN, with the inbox's username and password

The server only offers login after STARTTLS. A client set to connect without TLS gets no AUTH and cannot log in, so make sure STARTTLS is on. Port 465 (implicit TLS) is not offered.

Read-only API keys and grants get the settings without the password.

Configure your app

Node.js (Nodemailer)

import nodemailer from "nodemailer";

const transporter = nodemailer.createTransport({
  host: "smtp.hookinbox.com",
  port: 587,
  secure: false,
  requireTLS: true, // STARTTLS
  auth: {
    user: process.env.SMTP_USERNAME,
    pass: process.env.SMTP_PASSWORD,
  },
});

Rails

# config/environments/staging.rb
config.action_mailer.delivery_method = :smtp
config.action_mailer.smtp_settings = {
  address: "smtp.hookinbox.com",
  port: 587,
  user_name: ENV["SMTP_USERNAME"],
  password: ENV["SMTP_PASSWORD"],
  authentication: :plain,
  enable_starttls_auto: true
}

Django

# settings.py
EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
EMAIL_HOST = "smtp.hookinbox.com"
EMAIL_PORT = 587
EMAIL_HOST_USER = os.environ["SMTP_USERNAME"]
EMAIL_HOST_PASSWORD = os.environ["SMTP_PASSWORD"]
EMAIL_USE_TLS = True

Laravel

# .env
MAIL_MAILER=smtp
MAIL_HOST=smtp.hookinbox.com
MAIL_PORT=587
MAIL_USERNAME=your-inbox-username
MAIL_PASSWORD=your-inbox-password

Check from the command line

swaks --server smtp.hookinbox.com:587 --tls \
  --auth PLAIN --auth-user "$SMTP_USERNAME" --auth-password "$SMTP_PASSWORD" \
  --from [email protected] --to [email protected] --header "Subject: SMTP check"

What gets captured

• Every recipient. To, Cc and Bcc addresses all land in the inbox the credentials belong to, and the email's recipients lists every envelope recipient, Bcc included. Up to 100 recipients per message.
• The message as sent. Headers, text and HTML bodies and attachments are stored as for any received email, and the likely code and verification_link are extracted.
• Messages up to 10 MB. Larger messages are refused.

To tell runs apart, filter by recipient as usual: send to a unique address per run and wait with to=<address>. With the SMTP sandbox, the recipient can be any address, not just a hookinbox.com one.

Limits and errors

Emails captured through SMTP count toward your plan's email limits like any other email. When an inbox is at its limit, the server refuses the message with 552 and the reason. See Plans & Billing.

Reply	Meaning
530	You sent MAIL FROM without logging in
535	Wrong username or password
421	Too many failed logins; wait and retry
452	More than 100 recipients
552	The inbox reached its plan's email limit

Rotate the password

Regenerate password in the inbox's SMTP settings, or POST /api/v1/inboxes/:id/smtp/regenerate, replaces the password at once. The username stays the same.

Without SMTP

If your test harness builds emails itself, or can't reach port 587, store a message over HTTP with POST /api/v1/inboxes/:id/messages: send either a raw MIME message (Content-Type: message/rfc822) or JSON fields.

curl -X POST "https://app.hooklistener.com/api/v1/inboxes/$INBOX_ID/messages" \
  -H "Authorization: Bearer $HOOKLISTENER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "Acme <[email protected]>",
    "to": ["[email protected]"],
    "subject": "Your login code",
    "text": "Your code is 482913"
  }'

JSON accepts from, to, cc, bcc, subject, text, html and headers. The reply is 201 Created with the stored email.