MailCode API
API v2.0 · REST JSON

Developer Docs

Integrate MailCode into your bots, scripts, and apps. Fetch OTP codes from Outlook / Hotmail via Microsoft Graph.

Endpoints

Available routes

All responses are JSON. Base URL is auto-detected for your domain below.

POST /api.php?action=fetch

Main endpoint — pass credentials, receive extracted OTP code and recent messages.

Credential line email|password|token|client_id|recovery_email First four fields are required. recovery_email is optional.
FieldDescription
emailrequiredOutlook / Hotmail / Live address
passwordrequiredAccount password (must not be empty)
refresh_tokenrequiredOAuth refresh token (or a valid access JWT)
client_idrequiredOAuth app client ID, UUID format (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
recovery_emailoptionalRecovery address. If sent, it must be a valid email.
GET /api.php?action=status

Health check — returns service name, version, and server time.

FOCI token exchangeTries multiple Microsoft client IDs automatically for higher success rate.
Smart OTP extractionDetects Google, Facebook, LinkedIn, and standard numeric codes.
Live tester

Try it now

Paste one credential line, same format as the main app: email|password|token|client_id, plus an optional |recovery_email at the end.

Response Awaiting request 
{
  "status": true,
  "code": "847291",
  "icon": "fa-brands fa-google",
  "email": "user@hotmail.com",
  "messages": [ "..." ]
}
Code snippets

Copy & paste

URLs below are configured for your current domain.

curl -X POST "https://your-domain.com/api.php?action=fetch" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@hotmail.com",
    "password": "YOUR_PASSWORD",
    "refresh_token": "YOUR_REFRESH_TOKEN",
    "client_id": "YOUR_CLIENT_ID"
  }'
import requests

r = requests.post(
    "https://your-domain.com/api.php?action=fetch",
    json={
        "email": "user@hotmail.com",
        "password": "YOUR_PASSWORD",
        "refresh_token": "YOUR_REFRESH_TOKEN",
        "client_id": "YOUR_CLIENT_ID"
    },
    timeout=30
)
data = r.json()
print(data["code"] if data.get("status") else data.get("error"))
const res = await fetch("https://your-domain.com/api.php?action=fetch", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    email: "user@hotmail.com",
    password: "YOUR_PASSWORD",
    refresh_token: "YOUR_REFRESH_TOKEN",
    client_id: "YOUR_CLIENT_ID"
  })
});
const data = await res.json();
console.log(data.status ? data.code : data.error);
$ch = curl_init("https://your-domain.com/api.php?action=fetch");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'email' => 'user@hotmail.com',
        'password' => 'YOUR_PASSWORD',
        'refresh_token' => 'YOUR_REFRESH_TOKEN',
        'client_id' => 'YOUR_CLIENT_ID',
    ]),
]);
$data = json_decode(curl_exec($ch), true);
echo $data['status'] ? $data['code'] : $data['error'];
Error reference

Common responses

The API returns error_code to help you handle failures correctly.

Copied!