Any email address used in a flow must be on your team’s Email Allowlist.
Examples
Verify a signup confirmation or magic link Use a fresh inbox and fill it into your app’s email field. Wait for the message after the triggering action.after immediately before the action that sends the code to avoid matching an older message from the same address.
waitForMessages when one action should trigger several emails, such as a team invite or multi-step onboarding sequence. Use delay if your app enqueues email work in the background.
sendMessage when your app receives or reacts to incoming email — for example, a support reply or an automated trigger.
attachments array to sendMessage. Use contentId when the HTML body references an inline file.
When to use
- Your app sends a confirmation, magic link, or verification code by email.
- Your app sends a batch of emails when a user action occurs.
- Your app receives or reacts to inbound email.
- You need a fresh, isolated inbox for every test run.
- Your app processes email replies or attachments.
The Email Allowlist
QA Wolf includes an Email Allowlist to ensure test emails are delivered only to approved addresses or domains. You must add any email address used in a flow to the allowlist before running the flow. QA Wolf provides internal email domains — qawolf.email and qawolfworkflows.com — for email testing. These are recommended over public email services because QA Wolf controls the servers, which stabilizes tests that rely on email interactions. The platform sets an automatic default address. You cannot delete the default. To add or change the default email address:1
Click the icon on the upper right. A drawer opens.
2
Click Addresses.
3
Enter the username and domain in the appropriate fields, then click Add.a. You can create as many email addresses as you like in the allowlist.b. To change the default, hover over the address you want to set as default, click the icon, and select Make default.

Address options
Use a fresh address for each run Passnew: true to generate a unique derived address. This is the right choice for most tests — it isolates each run so old emails from previous runs are never matched.
+ addressing, use a custom delimiter: