Automating magic link sign-in tests with Playwright and InboxRhino
Eliminate arbitrary sleep loops in Playwright by combining temporary MX inboxes with a long-polling API to extract passwordless login links.
Prevent race conditions in parallel test runs by applying sender and subject filters directly at the API query level.
Parallel test suites run fast. They also break easily when email assertions rely on race-prone assumptions. When multiple worker threads fire off account registration, password reset, and billing notification emails simultaneously, grabbing the latest message from an inbox causes intermittent failures. One test runner expects a verification code, but it receives an invoice receipt sent a millisecond later. The test fails, developer time is wasted, and the build pipeline stalls.
The root cause is client-side sorting on unfiltered message lists. Fetching every incoming email and filtering array elements in your test suite code introduces timing gaps and unnecessary API load. To achieve deterministic automated email testing, QA teams must shift filtering logic directly to the API server query layer.
When testing against real MX infrastructure, messages arrive with realistic network latency. As discussed in our analysis on public MX versus local SMTP sandboxes in staging tests, real MX routing exposes deliverability issues that local mocks hide. However, real routing requires strict filtering precision.
Server-side query filtering guarantees that your HTTP request returns only the message matching your specific criteria. Instead of fetching a list of ten emails and running a JavaScript filter in your test harness, the API holds the connection and returns the single payload that satisfies your query.
InboxRhino supports native query parameters for subject line targeting alongside wait-for-message capability. When a request includes parameters like subject=Verify and wait_seconds=180, the server blocks until an email arriving at that receive-only inbox matches the expected subject string.
Executing targeted inbox queries requires structuring your fetch calls to pass key filter flags. The wait-for-message endpoint supports four primary parameters for narrowing incoming mail:
When combining these parameters, a single request to https://api.inboxrhino.in/v1/inboxes/{id}/messages?wait_seconds=180&limit=1&include=content&subject=Verify waits actively for the sign-up verification email while ignoring irrelevant messages hitting the inbox.
This approach builds on the long-polling patterns detailed in our guide on automating password reset tests with long-polling email APIs. By combining long-polling with string filtering, you eliminate sleep timeouts, retry loops, and unneeded polling requests.
To run parallel tests without collision, combine inbox isolation with targeted query parameters. Create a dedicated receive-only address per test worker or test scenario. Since generated test inboxes are receive-only and cannot send, reply, or forward messages, you avoid risks of outbound spam or test loops.
On the free tier, InboxRhino provides 11 active inboxes, 33 inbound emails per UTC calendar month, and 1 organisation user. This allocation allows developers to wire up a deterministic local test flow. For higher volume CI runs, teams can scale up as needed.
Stored messages, headers, and attachments are retained for 30 days before deletion. This retention window allows QA engineers to inspect failed assertions long after the pipeline run finishes.
When an assertion fails—for example, if a developer changes the subject template from "Verify your email" to "Confirm your account"—the wait API times out after 180 seconds. Debugging requires viewing what actually arrived in the mailbox.
Visual inspection should happen in a secure viewer. InboxRhino includes a sandboxed console viewer that renders raw message HTML while explicitly blocking scripts, forms, popups, and remote tracking images. Developers and QA engineers can open the exact HTML delivered over public Cloudflare MX routes without executing untrusted scripts or triggering tracking pixels in staging environments.
To maintain robust test suites, follow these three rules when writing email assertions:
Applying strict sender and subject filtering ensures your test suite runs clean, stays fast, and remains deterministic across every staging deployment.
Eliminate arbitrary sleep loops in Playwright by combining temporary MX inboxes with a long-polling API to extract passwordless login links.
Rendering raw HTML in test email viewers exposes staging environments to cross-site scripting, tracking pixel leaks, and untrusted form submissions.
Ditch custom sleep loops and flaky retry logic by holding open a single HTTP request while testing your forgot-password email flows.