The App QA Testing Account Stack for 2026: Email, SMS, OAuth

What a QA test account stack is, and when you do not need to buy one

Buy email accounts for testing only when your signup, verification and password-reset tests cannot run cleanly against plus-addressed inboxes, an API mail service or a Cloud Identity Free tenant. If they already run there, keep them there. Those options are cheaper to automate, reset between runs, and cover most unit and CI email checks.

Real consumer accounts earn their cost in four situations:

1. The flow blocks disposable domains. Your fraud rules, or a vendor in your signup path, reject throwaway addresses before the test reaches the part you care about.
2. Provider behavior is under test. How Gmail, Outlook.com and Yahoo filter or render your transactional mail cannot be reproduced by a catch-all inbox.
3. OAuth needs several separate personal identities. Sign in with Google, Microsoft or GitHub only proves the consumer path when a distinct personal account sits behind each persona.
4. SMS OTP needs a persistent number. Regression suites need one number to receive codes release after release, without those codes appearing on a public receive-SMS page.

Think in five layers: Gmail, Outlook and Hotmail, Yahoo, Google Voice, and GitHub. A starter kit at product minimums is 5 Gmail New (Fresh PVA) at $1, 5 Outlook New (Fresh PVA) at $1.25, 10 Yahoo New (Fresh PVA) at $0.65, 3 Google Voice USA Mix at $4.50 and 3 GitHub New (Email Verified) at $6, which comes to $49.25. Already know your personas? Send the platform, variant and quantity to @nexkyc on Telegram or +1 (737) 307-6751 on WhatsApp.

Where disposable inboxes and plus-addressing break signup tests

Disposable addresses usually fail signup tests for one of four reasons: blocklists of known disposable domains, rate limits on repeated signups from one domain, abuse flags on shared public inboxes, and filters at your own email provider that suppress mail to low-reputation domains, so the verification message never goes out.

Plus-addressing fails differently. qatester+run42@gmail.com and qa.tester@gmail.com land in one mailbox. That is the point of the feature, and why it cannot test distinct users. If your app normalizes addresses to stop duplicate signups, every tag and dot variant collapses into one user. Any test that needs two genuinely separate people, such as account linking, referral credit, invite acceptance or a dedupe rule that must never merge two customers, needs two real mailboxes.

That is the job for Gmail New (Fresh PVA) accounts at $1 each: one for every separate person in those tests, and for repeat signup runs that normalization would otherwise merge. Gmail orders start at 5 accounts.

Layer 1: Gmail for Sign in with Google, OAuth consent and account linking

Write the persona matrix before counting accounts. A realistic Sign in with Google suite covers these states:

• Brand-new user who has never authorized your app
• Returning user with a live session and a stored refresh token
• Linking user who registered with email and password, then connects Google
• Revoked user who removed your app from their Google account permissions
• Re-consent user whose authorization lapsed and must approve scopes again

With the OAuth app in Testing publishing status, Google limits the project to 100 listed test users, whose authorizations expire seven days after consent. If the app, Sign in with Google included, requests only name, email address and profile, users need not be listed and authorizations do not expire after seven days. Any other scope brings both rules back, so schedule re-consent as a deliberate step and keep test-user slots off one-shot accounts.

Match the grade to how long each persona lives, then order from the Gmail accounts page:

The aged grades suit personas that sign in nightly for months; the trade-off is in our aged versus fresh comparison. In Playwright or Cypress, read long-lived inboxes through the Gmail API on an OAuth client your team owns. Mail-read access is beyond basic scopes, so while that client is in Testing each persona takes a test-user slot; read one-shot inboxes over IMAP with an app password, which needs 2-Step Verification on.

Layer 2: Outlook and Hotmail for Microsoft-side sign-in and mail rendering

Three test jobs live here. Sign in with Microsoft behaves differently for personal accounts than for work or school accounts, so personal personas need their own coverage. Transactional mail renders and filters differently in Outlook.com, where a receipt template can break in ways Gmail never shows. And hotmail.com addresses surface older validation bugs, such as an allowlist that only accepts outlook.com.

Microsoft ended Basic Authentication for Outlook.com and Hotmail accounts on September 16, 2024, and app passwords count as Basic Auth, so IMAP sign-in with a password fails. Read test mail through Microsoft Graph or IMAP with an OAuth2 token, and register that app before the accounts arrive.

Outlook accounts, 5-account minimum:

• New (Fresh PVA), $1.25: Sign in with Microsoft signup tests and Outlook.com rendering checks
• Mix Old (2023-2014), $2.10: longer-lived regression personas
• UK IP Old, $3: UK-registered Microsoft personas
• USA Old (2023-2014), $3.30: stable US personas across releases

Hotmail accounts, 10-account minimum:

• New (Fresh PVA), $0.99: the lowest-cost hotmail.com address for bulk signup runs and outlook.com-only allowlist bugs
• Mix Old (2023-2014), $1.65: per-client personas for agencies
• EU IP Old, $2.30: EU-registered personas for EU onboarding runs
• USA Old (2023-2014), $2.75: stable US hotmail.com personas

Layer 3: Yahoo as the third filter your transactional mail must clear

A confirmation that reaches the inbox at Gmail and Outlook.com can still be filtered at Yahoo. If your customer list includes yahoo.com addresses, those customers notice when a receipt never arrives.

Keep at least one Yahoo persona in every release smoke run, and check the signup confirmation, password reset and receipt. Yahoo accounts carry a 10-account minimum:

• New (Fresh PVA), $0.65: confirms signup, reset and receipt mail arrives and renders at Yahoo in smoke runs
• Mix Old (2023-2014), $1.50: per-client Yahoo personas for agencies, and aged seed inboxes for placement checks
• EU IP Old, $2: EU-registered Yahoo personas
• USA Old (2023-2014), $2.75: long-lived US personas

Layer 4: Google Voice numbers for SMS OTP and phone-verification tests

Public receive-SMS websites fail QA twice over: their numbers rotate out of the pool, and every code is visible to anyone refreshing the page. A Google Voice line your team controls fixes both.

Be precise about what it is. Google Voice numbers are VoIP. If your verification provider runs a carrier lookup and rejects VoIP lines, a Google Voice number will be refused, often before any code is sent. That makes it the right tool for testing your own VoIP-rejection branch: the error copy, the retry path and the support fallback. If the flow under test needs a non-VoIP mobile number to succeed, Google Voice is not the tool.

Where your flow accepts VoIP, Google Voice accounts cover four jobs:

Orders start at 3 numbers. Google reclaims Voice numbers that go unused, so make a call, send a text or play a voicemail on every line regularly, release or no release.

Layer 5: GitHub for Sign in with GitHub, App installs and org roles

Any GitHub account in good standing can authorize an OAuth app, so one personal account covers the happy-path login. Permission tests need genuinely distinct users on each side of a role boundary:

• An organization owner who installs your GitHub App
• A repository admin who can change settings a member cannot
• A member with limited repository access
• An outside collaborator on a single repository
• A user who denies requested scopes at the authorization screen
• A member without two-factor authentication in an organization that requires it, locked out of org resources

GitHub accounts have a 3-account minimum:

• New (Email Verified), $6: member, collaborator, scope-denial and no-2FA personas, plus the owner seat in a throwaway run
• PVA + Profile (USA), $10: owner and repository-admin personas you keep across releases, since they arrive phone-verified and 30+ days old; clear the pre-filled bio and location if you want a blank profile
• Aged 1-Year+ with Activity, $48: only for an account-age or history check inside your own app. Its activity was created for sale, not by a real developer, so never use it where that history would be read as genuine

Pre-Warmed (Niche Commit History) at $22, with its 50-unit minimum, is not a QA purchase. Commit history adds nothing to a permission test.

Sizing the stack: personas × environments × parallel runners

Every layer is sized with the same formula:

accounts = distinct personas per flow × environments × parallel CI workers, plus spares

Environments usually means dev, staging and a production smoke run, but a persona only multiplies across them when its state in one would conflict with another. Workers only multiply when two jobs could sign in to one account at once. Add one spare for every five or six active accounts, rounding fractions up, so a locked persona never holds up a release, then round up to the product minimum.

Applied to a SaaS product with Google, Microsoft and GitHub sign-in, SMS two-factor, two environments (staging and production smoke) and up to four parallel CI workers:

Those are list prices; ask for the rate on the whole order.

Three builds priced: solo developer, SaaS QA team, testing agency

Alongside the $234.50 SaaS QA team build above, two sizes fit a solo developer and a testing agency.

Solo app developer. One environment, no parallel workers, one persona per provider rounded up to each product minimum:

Testing agency, per client. One client’s persona should never touch another client’s product. Each isolated kit uses Mix Old email grades and aged Google Voice lines, so personas last through a long engagement:

Eight client kits come to $784 at list; send that order on Telegram or WhatsApp and ask for the full-order rate before you pay.

Handling rules that keep test personas usable

• One persona per account. Never share a login across clients, projects or unrelated suites.
• Vault the delivery file. Move the credentials and recovery details into your team’s secrets manager, not a shared spreadsheet.
• Sign in once, as delivered, the day the order lands. That keeps any failure inside the seven-day replacement window. In a later session, change the password and add your own two-factor method, except on a persona that must stay without it.
• Stop at a security challenge. Pull that persona from the suite rather than working around the provider’s check.

If a persona does lock, the first-hour recovery playbook explains how to read the block and which ones are worth clearing.

What this stack is not for

This stack exists to test your own product. It is not for filling Google Play’s 12-tester closed testing requirement: Google reviews how testers engaged with the app, and it can require more closed testing when engagement falls short. It is not for posting reviews, inflating usage figures, or getting past another company’s anti-abuse systems.

Buying accounts is against Google, Microsoft, Yahoo and GitHub terms of service whatever the purpose, and any of them can disable an account at any time. Where a provider offers sanctioned test identities, such as Cloud Identity Free or a sandbox environment, use those first and buy only for the gaps they leave. The wider compliance picture is in our 2026 legal overview.

How MixAcc supplies a QA account stack

All six lines go on one order: Gmail, Outlook, Hotmail, Yahoo, Google Voice and GitHub. All inventory is created, never acquired from previous owners, and each account comes with a delivery file holding its credentials and recovery details.

The replacement window is 7 days from delivery, on every grade. If an account fails its first sign-in within that window, tell us and it is replaced; no recording or support ticket is needed. Payment is by crypto, or by card against an invoice; if you want to pay by card, confirm it for your order size when you message us.

To order, send the platform, variant and quantity you need to Telegram @nexkyc or WhatsApp +1 (737) 307-6751, and ask for the full-order rate. If you would rather have the stack sized for you, send your persona matrix, environments and runner count there, or email allmixacc@gmail.com.