Tempik - Disposable Temp Mail on Cloudflare Workers

Tempik is the simplest email project in this Cloudflare run.

The previous posts were about real inboxes, AI agents, custom-domain webmail, and SaaS customer messaging.

Tempik is different:

disposable temp mail
receive-only
anonymous sessions
Cloudflare Workers + D1

That makes it useful, but it also makes the boundaries very clear.

This is not a private mailbox.

It is a self-hosted temp-mail service for throwaway addresses.

What Is Tempik?

Tempik describes itself as:

Disposable Temp Mail on Cloudflare Workers.

• Tempik GitHub Source Code
• Tempik API Docs
• Cloudflare Email Workers Docs
• Cloudflare D1 Docs

I inspected:

repo: https://github.com/hirotomasato/tempik
commit: 36d05edc7010039664716559acd3d623d5738188
version: 1.0.0
license: MIT

The app lets visitors create disposable addresses on your domain, receive email through Cloudflare Email Workers, and read those messages in a browser UI.

There is no VPS, no Postfix, no Docker, and no SMTP daemon.

What You Get

Tempik includes:

• disposable email inbox creation;
• random human-readable address generation;
• custom local-part creation;
• multiple configured mail domains through MAIL_DOMAIN;
• anonymous browser sessions;
• session-scoped inbox list;
• inbound email parsing with PostalMime;
• D1 message storage;
• Hono REST API;
• vanilla HTML/CSS/JavaScript web UI;
• Cloudflare Workers Assets for static files;
• Cloudflare Email Worker email() handler.

It does not include:

• user accounts;
• passwords;
• API keys;
• outbound sending;
• attachments storage;
• message expiration;
• automatic cleanup;
• OAuth;
• MCP;
• PWA install manifest;
• Docker deployment.

That makes it smaller than every other email app we covered recently.

And for disposable mail, smaller is not necessarily bad.

Stack

The stack is:

The wrangler.toml is short:

name = "tempik"
main = "src/index.ts"
compatibility_date = "2025-06-01"
workers_dev = false

[[d1_databases]]
binding = "DB"
database_name = "tempik-db"
database_id = ""

[email]
action = "process"

[[routes]]
pattern = "tempik.YOURDOMAIN.com"
custom_domain = true

[vars]
APP_NAME = "Tempik"
MAIL_DOMAIN = "YOURDOMAIN.com"
WEB_HOST = "tempik.YOURDOMAIN.com"

[assets]
directory = "./src/web"

There are two handlers:

• fetch() handles /api/* routes.
• email() handles inbound mail from Cloudflare Email Workers.

Static files come from:

src/web/index.html
src/web/app.js
src/web/styles.css

How Tempik Works

The flow is:

Sender
  -> Cloudflare MX
  -> Email Worker
  -> PostalMime
  -> D1
  -> Hono API
  -> browser UI

When mail arrives, Tempik:

1. lowercases the sender and destination;
2. parses the raw MIME stream with PostalMime;
3. uses the text body when available, or HTML as fallback;
4. auto-creates the target inbox if it does not exist;
5. stores the message in D1.

The important part: inbound messages auto-create inbox records.

Then a browser session can create or claim an inbox address and read messages linked to that address.

Database Schema

Tempik uses four D1 tables:

The message table stores:

id
inbox_address
from_address
subject
body
received_at

There is no attachments table and no retention policy in the inspected schema.

If you run this publicly, plan cleanup.

API

Tempik’s API lives under:

/api/

Authentication is an anonymous session token:

1. Call GET /api/session.
2. Store the returned sessionId.
3. Send it as x-session-id.

Important endpoints:

Example:

SESSION=$(curl -s https://tempik.example.com/api/session | jq -r .sessionId)

curl -s -X POST https://tempik.example.com/api/inboxes \
  -H "x-session-id: $SESSION" \
  -H "Content-Type: application/json" \
  -d '{"localPart":"demo"}'

curl -s https://tempik.example.com/api/inboxes/[email protected]/messages \
  -H "x-session-id: $SESSION"

That makes Tempik easy to script, but it is not an authenticated API.

Self-Hosting Tempik

There is no Docker Compose setup for Tempik.

The deployment target is Cloudflare Workers.

Manual setup:

git clone https://github.com/hirotomasato/tempik.git
cd tempik
npm install
npx wrangler login
npx wrangler d1 create tempik-db

Copy the generated database_id into wrangler.toml.

Apply the schema:

npx wrangler d1 execute tempik-db --remote --file=src/db/schema.sql

Deploy:

npx wrangler deploy

Then verify Email Routing:

npx wrangler email routing settings YOURDOMAIN.com
npx wrangler email routing rules list YOURDOMAIN.com

The expected shape is a catch-all rule that sends mail for your domain to the Tempik Worker.

DNS and Email Notes

You need a domain on Cloudflare.

The web UI route points to a subdomain such as:

tempik.example.com

Mail receives on addresses under:

*@example.com

The README recommends adding an SPF record if one is not already present:

v=spf1 include:_spf.mx.cloudflare.net ~all

For disposable receive-only mail, deliverability is mostly about inbound routing working. Tempik does not send mail.

Security Reality Check

Tempik is disposable mail.

Do not use it for:

• bank logins;
• primary accounts;
• sensitive OTPs;
• private customer communication;
• long-lived account recovery;
• confidential documents.

The inspected code uses anonymous browser sessions. A session can only read inboxes linked to that session.

But inboxes can be claimed by address. If someone knows the exact disposable address, they can link that inbox to their own session through POST /api/inboxes and read messages stored for it.

That is acceptable for a temp-mail tool, but not for private email.

If you expose Tempik publicly, consider adding:

• automatic message expiration;
• automatic inbox expiration;
• rate limiting;
• abuse controls;
• attachment rejection or explicit attachment handling;
• domain/local-part restrictions;
• cleanup jobs;
• observability alerts.

Field Note: Local Trial

I tried the project locally in a temporary clone.

Environment:

node: v18.19.1
npm: 9.2.0

Commands:

npm install
npx wrangler --version
npx tsc --noEmit

npm install completed, but showed engine warnings for Wrangler, Miniflare, Undici, and Cloudflare packages.

npx wrangler --version failed on this machine:

Wrangler requires at least Node.js v20.0.0. You are using v18.19.1.

npx tsc --noEmit passed.

So the TypeScript source checks out, but local Worker/D1 testing and deployment need Node 20+.

I did not add a Home-Lab Compose file because this is not a Docker app.

How It Compares

Tempik is the least cluttered.

It is also the least private, least durable, and least feature-complete by design.

FAQ

your app -> SMTP mailpit:1025 -> Mailpit web UI at :8025

external sender -> Cloudflare Email Worker -> Tempik D1 inbox

Conclusion

Tempik is refreshingly small.

It does one thing: disposable inbound email on Cloudflare Workers.

That simplicity is its strength. It also defines the limits.

Use Tempik for throwaway addresses, testing signups, demos, and short-lived receive-only mail.

Use QuickInbox, Mailflare, or SaaSMail when you need real inbox ownership, stronger identity, attachments, outbound sending, or production customer communication.

Final Use-Case Chooser

Here is the practical map I would use after looking at all these tools:

Mailpit is the one I would keep closest in a homelab dev stack: it answers “did my app generate the right email?” without involving real mailboxes.

Tempik answers a different question: “can I receive throwaway inbound mail on my own domain?”

Notifuse and GrowChief sit higher in the funnel. Notifuse is for email campaigns and transactional email operations. GrowChief is for social/outreach workflow execution, and should be treated carefully because account automation can violate platform terms.