---
title: "Extend the lease"
description: "Another hour on the expiry, up to the day a lease is capped at. No body."
url: "https://nextmail.sh/docs/api/temp-mail/extend"
area: "API"
category: "Disposable inboxes"
---

# Extend the lease

Another hour on the expiry, up to the day a lease is capped at. No body.

`POST /temp-mail/inboxes/{id}/extend`

## POST /temp-mail/inboxes/{id}/extend

Another hour on the expiry, up to the day a lease is capped at. No body.

## The inbox token

**shell**

```
export OE=https://api.nextmail.sh
export INBOX="Authorization: Bearer oe_inbox_kQ8v…"
```

Every call below carries the token `POST /temp-mail/inboxes` returned, in the same `Authorization: Bearer` header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.

> The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.

## Example

The hour is added to `expiresAt`, not to now, so extending with time still on the clock keeps that time.

**curl**

```
curl -X POST "$OE/temp-mail/inboxes/tinb_octopus-signup/extend" -H "$INBOX"
```

**Response**

```
{
  "object": "temp_inbox",
  "id": "tinb_octopus-signup",
  "address": "octopus-signup@freemailaddress.com",
  "domain": "freemailaddress.com",
  "createdAt": "2026-09-01T10:00:00.000Z",
  "expiresAt": "2026-09-01T13:00:00.000Z",
  "extensionsLeft": 22,
  "messageCount": 0,
  "messageLimit": 50,
  "lastMessageAt": null,
  "token": "oe_inbox_Lm3w…"
}
```

> The answer carries a new `token` with the later expiry, and the old token keeps its old one, so keep the new one. It reads no mail, so `messageCount` is 0 and `lastMessageAt` is null on it.

> Twenty-three extensions, and the new expiry is also clamped to 24 hours after `createdAt`, so the last one may buy less than a full hour, and on a lease created at the cap every one of them buys nothing. `extensionsLeft` counts only the 23, so read `expiresAt` back rather than trusting it.

> Once all 23 are spent it answers 422 `validation_error` / `extension_limit`. That is the end of it: take a new address, or a real mailbox, which does not expire.

## Reference

- [`POST /temp-mail/inboxes/{id}/extend`](https://nextmail.sh/docs/api/reference/temp-mail#post-temp-mail-inboxes-id-extend): full reference