Test the complete password reset journey.

Start with a synthetic account

Create a test account with a unique address such as reset+run-123@example.test in your staging application. Configure its mailer to use an SMTPBox inbox. Trigger the same password-reset action a user would use.

Check the email before following its link

1. Wait for the full test recipient and expected subject using the API.
2. Wait for message processing, then fetch message metadata.
3. Check the sender, recipient and reset instructions.
4. Find the intended reset link among the extracted links.
5. Check its origin against your known staging application URL.

Do not blindly follow the first URL in an email: templates often contain logos, footer links and tracking URLs. Restrict automated navigation to the trusted test application and the expected path.

Assert the application outcome

Open the validated reset URL, choose a new test password and confirm that the account can sign in. Then try the same token again and check the application rejects it. Exercise expired tokens using your application's test clock or test fixtures rather than waiting in real time.

Useful failure cases

• The reset email uses a production hostname in a staging test.
• A template variable or token is missing.
• The text version has a different or broken link.
• An already-used or expired token still works.
• The reset request leaks whether an unknown account exists.

The last two are application assertions. SMTPBox supplies the captured email; your application test must prove the account behaviour.

Use the same pattern for verification emails

Trigger signup, wait for the verification message, validate the link and confirm the account changes to verified. Keep the same unique recipient throughout the flow so parallel runs cannot consume one another's email.

Automate and clean up

The Playwright guide demonstrates safe link selection. Delete the test message with a read/write API key and remove synthetic accounts through your application fixtures. Avoid writing token URLs or message bodies to public CI logs.

Updated 7 September 2026