Quickstart

1

Create a sandbox

In the dashboard, hit + and create one. A sandbox is one trap with two ways in — an SMTP credential and a capture URL — and its page hands you both. Keep the page open; the next two steps paste from it.

More on sandboxes →

2

Trap your first email

Prove the path works before you change anything in your app. Paste this:

curl smtp://smtp.trapit.dev:587 \
  --user "YOUR-SANDBOX-ID:YOUR-SANDBOX-SECRET" \
  --mail-from "dev@example.com" \
  --mail-rcpt "anything@example.com" \
  --upload-file - <<'EOF'
Subject: Your verification code

Your code is 519274.
EOF

It lands in the sandbox immediately — parsed into subject, sender, bodies and attachments, with the original source kept intact. Messages up to 10 MB are accepted; larger ones are rejected outright rather than truncated.

Now point your app at it

Same credentials, in whatever your app already reads its SMTP settings from:

# The username is the sandbox id; the password is its secret.
SMTP_HOST=smtp.trapit.dev
SMTP_PORT=587
SMTP_USER=<sandbox-id>
SMTP_PASS=<sandbox-secret>

587 is the submission port, with STARTTLS before AUTH. Mailers that want TLS from the first byte can use 465; the email capture page covers the alternatives.

That's the whole integration. Who the mail is addressed to doesn't matter — whatever your app already sends to, a fixture address or a real customer's, is trapped by the sandbox that authenticated. There is no address to create, derive, or rewrite, so nothing else in your app changes.

3

Trap your first HTTP request

The other half, same sandbox. Its capture URL is https://<sandbox-id>.trapit.dev — the id from step 2, now a hostname. Point a webhook at it: any path, any method.

curl -X POST https://YOUR-SANDBOX-ID.trapit.dev/webhooks/payment \
  -H "Content-Type: application/json" \
  -d '{"event":"payment.succeeded","amount":4200}'

The request is captured with its method, path, query, headers and body — and answered with your mock response, which you can edit on the sandbox. Set it to a 500 to see how your retry logic behaves, or return the JSON the real provider would send. The request never reaches anything else.

4

See it in the UI

Open the sandbox and both of those are waiting for you, on their own tabs: Email for what you sent in step 2, HTTP for step 3. The tab you aren't on still shows its count, so nothing hides.

Click a row and the viewer opens:

• Email — the rendered HTML body in a sandboxed frame, the plain-text alternative, every header, and attachments to download. Remote images and web fonts are blocked, so opening a trapped message can't tell its sender you read it.
• HTTP — method, path, query params and headers broken out, the body pretty-printed as JSON, and the raw bytes exactly as they arrived.

Search filters across every page, not just the one on screen, and the list updates live as new traffic lands — no refreshing to see whether the thing you're waiting for arrived.

In CI you'd read the same thing over the REST API instead. REST API →

5

Hand the loop to an agent

This is the part TrapIt is built for. Add the MCP server to any client that speaks MCP — Claude, ChatGPT, Cursor, VS Code, Claude Code:

https://mcp.trapit.io/mcp

Sign in when it prompts, and approve the connection. No API key: the client registers itself and gets a token scoped to your workspace, which it refreshes on its own.

Then your agent can drive the whole flow without you writing any glue:

Behind that: create_sandbox mints a throwaway sandbox that expires by itself and hands back the SMTP credentials to point staging at, wait_for_email blocks until the mail lands instead of polling, and extract_otp pulls the passcode out of the prose. All the tools →