ephemail covers the mailsac api surface and adds the controls modern qa, growth, and platform teams ask for. see /docs/migrating-from-mailsac for the endpoint map.
core api
| capability | mailsac | ephemail |
|---|---|---|
| disposable addresses on shared domain | ● | ● |
| custom domains (mx + dkim + dmarc) | ● | ● |
| fetch messages (json) | ● | ● |
| raw mime download | ● | ● |
| attachments | ● | ● |
| send outbound | ● | ● |
| webhook on new message | ● | ● |
| sms / mms inbound | ◐ | ○ |
| imap / pop3 access | ○ | ● |
developer experience
| capability | mailsac | ephemail |
|---|---|---|
| typed sdks (ts, py, go, rb) | ◐ | ● |
| waitForMessage helper with otp extract | ○ | ● |
| openapi 3.1 spec, live explorer | ◐ | ● |
| ci recipes (playwright, cypress, jest, pytest, gh, gitlab) | ◐ | ● |
| realtime stream (sse / ws) | ○ | ● |
security & compliance
| capability | mailsac | ephemail |
|---|---|---|
| per-key ip allowlist | ○ | ● |
| dashboard ip allowlist | ○ | ● |
| saml sso + scim | ○ | ● |
| domain claim → forced sso | ○ | ● |
| audit log with csv/json export | ◐ | ● |
| soc 2 type ii | ◐ | in audit (q1 2027) |
| dpa + sub-processor list | ◐ | ● |
| dmarc enforcement on custom domains | ○ | ● |
| html sanitization profiles | ○ | ● |
operations
| capability | mailsac | ephemail |
|---|---|---|
| per-workspace rate limits | ◐ | ● |
| per-address burst limits | ○ | ● |
| abuse auto-pause + reactivation flow | ○ | ● |
| status page with 90d uptime sparklines | ◐ | ● |
| eu region | ○ | ● |
pricing posture
free tier for development; metered pro and team plans; enterprise with sso, scim, and unlimited retention. see pricing.
migrating
most teams move in under an hour. the endpoint map is at /docs/migrating-from-mailsac and the sdks share method names where it's safe (addresses, messages, wait, send, validate, webhooks, domains).
legend: ● supported · ◐ partial · ○ not supported