OAuth email tests often fail in a deceptively simple way: the test proves that a message arrived, but never proves how many times its link can be used, who can use it, or what evidence remains after the run. That is a problem because an email callback is part of the authentication boundary, even when the mailbox is only a test fixture.

I now treat every OAuth test email as having a replay budget. The budget is not always one click; some flows need a refresh, a retry, or a second assertion. The important thing is that the allowed behavior is explicit, bounded, and checked. A test that leaves an old callback usable is quietly teaching the product to trust stale identity evidence.

Why OAuth email tests need a replay budget

In a normal OAuth flow, the provider response, application session, state value, and email verification step are related.…