blog

A temporary email address that doesn’t expire

Most temp mail addresses vanish within the hour. Here’s how a key-derived address never expires while the messages it receives still disappear after 24 hours.

Updated 4 min read

On this page
  1. Two clocks
  2. How the address works
  3. Why it never expires
  4. What still expires
  5. Coming back later
  6. You hold the key
  7. Keep or discard?

Most temporary email services hand you an address that dies with the browser tab, or after ten minutes, or an hour. That’s fine for a one-off download. It becomes a problem the first time you need a password reset for an account you made with it, or an agent needs to sign back in to a tool next week.

Agent Temp Mail separates the two things that usually expire together. Messages are temporary: 24 hours by default. The address isn’t. Here’s how that works, and what it means for keeping or discarding an inbox.

Two things that can expire

Every temporary inbox has two lifetimes:

  • The messages: how long each email is stored before it’s deleted.
  • The address: how long it keeps receiving mail, and how long you keep the ability to read it.

On most temp-mail sites the two are tied together. When the session ends, the inbox goes, and on some services the address can later be handed to someone else. Short message retention is a privacy feature. Short address lifetime is a limitation those services accept because they have to recycle names and have no other way to know who an inbox belongs to.

How a key-derived address works

Agent Temp Mail doesn’t assign addresses. You compute one:

  1. Generate an Ed25519 keypair (RFC 8032). The public key is 32 bytes.
  2. Encode those bytes as lowercase Base32 without padding (RFC 4648). That gives 52 characters, comfortably inside email’s 64-character limit for the part before the @.
  3. Add @agent-temp-mail.com.
Public key:  qx57c4wglcr5frztjzeayjvlmgwny7cywyt5v3n5ms54gtssmtsa
Address:     qx57c4wglcr5frztjzeayjvlmgwny7cywyt5v3n5ms54gtssmtsa@agent-temp-mail.com

When mail arrives, the server checks that the part before the @ is a well-formed key and stores the message under it. It doesn’t need to have seen the key before; the first message creates the storage. To read, you sign a request with the private key, and the server checks that signature against the public key in the address. No account, password, or registration is involved at any point.

Why the address never expires

There’s nothing to expire. The address isn’t a database record waiting to be cleaned up; it’s a property of the key. As long as you hold the private key and the service is running, you can prove the address is yours, whether that’s tomorrow or in three years. The service deletes stored messages on schedule, but the next email to the address simply starts a new store.

It can’t be recycled, either. Nobody else can be issued your address, because nobody is issued anything. Getting the same address would mean generating the same 256-bit key, which, for practical purposes, won’t happen.

What still expires

  • Messages: 24 hours by default. You can set retention for new messages anywhere from one hour to seven days. Changing it doesn’t extend messages already stored.
  • Read links: signed links for read-only clients, such as ChatGPT, last 10 minutes by default and 15 at most. You can sign a new one whenever you need it.
  • Request signatures: each signed API request is valid for about a minute and can be used once.

Idle storage is reclaimed too. If an address has no stored messages and no custom settings for seven days, its empty record is removed and quietly recreated on the next delivery. The address itself is unaffected.

Coming back to an address later

Keeping an address means keeping its key:

  • In the browser: use Export on agent-temp-mail.com to save the key as a file, and Import to open the same inbox later. Without an export, the key lives only in that tab.
  • With the SDK or CLI: keep the key file. loadIdentity(path) reopens it, and agent-temp-mail keygen creates one.
  • In an MCP client: the server’s MAIL_KEY_FILE is the inbox. Keep that file, and set MAIL_REQUIRE_EXISTING_KEY=1 so a wrong path fails loudly instead of creating a new address.
import { loadIdentity, MailClient } from "agent-temp-mail";

// First run: creates the key file. On later runs, drop { create: true }
// so a missing file is an error instead of a brand-new address.
const identity = await loadIdentity("/secure/place/agent.key.json", { create: true });
console.log(new MailClient(identity).address);

You hold the key

There’s no account behind the address, so there’s no password to phish, no account database to breach, and no support desk that can be talked into handing your inbox to someone else. The key is the inbox, and only you have it.

That makes the key worth looking after. Keep one copy somewhere safe, like a password manager, and none in repositories, logs, or shared chats. With the key in hand, you can come back to the address at any time.

Keep it or throw it away?

You decide per address, and you can decide after the fact:

  • Disposable: don’t save the key. Once it’s gone, nobody can read the address, including you. That’s the right default for a single code or a test.
  • Persistent: save the key. That suits an agent identity that signs in to the same tools over time, or any account you might need to recover.

Either way, nobody else can read it: knowing the address lets someone send you mail, not open your inbox. For agents, that combination—free to create, permanent, and readable only by the key holder—is exactly what sign-ups need. How to give an AI agent its own email address covers the ways to set one up.