MCP server

SendLit exposes the same team-scoped email capabilities through a Model Context Protocol (MCP) server. MCP clients connect to the Streamable HTTP endpoint:

https://api.sendlit.app/mcp

For a local installation, replace the origin with the API origin configured in your environment, for example http://localhost:5000/mcp.

Connect and authenticate

The endpoint accepts JSON-RPC over HTTP. A client creates a session with the MCP initialize request, then sends later requests with the returned Mcp-Session-Id header. The server also supports JSON responses for clients that do not use server-sent events.

Authenticate with one of these headers:

Authorization: Bearer <oauth-access-token>

or:

x-sendlit-apikey: sl_live_...

OAuth-capable clients should discover the protected-resource metadata before starting authorization:

GET /.well-known/oauth-protected-resource
GET /.well-known/oauth-protected-resource/mcp
GET /.well-known/oauth-authorization-server
GET /.well-known/openid-configuration

OAuth authorization, consent, token, introspection, revocation, and userinfo endpoints are provided under /api/auth/oauth2/*.

MCP clients may dynamically register a public OAuth client. Use Authorization Code with S256 PKCE, request only the scopes your client needs, and keep any refresh token in the client's secure credential store. Dynamic registration does not grant access by itself: every authorization still requires a SendLit user to sign in, select a team when necessary, and approve consent.

API keys always select one fixed team. Dashboard-session clients that can access multiple teams must provide X-Sendlit-Team-Id; clients with exactly one team may omit it.

OAuth clients (including MCP clients like Claude) have no way to send a custom header during authorization, so a multi-team account instead picks a team as part of the OAuth flow itself: after login, and before the consent screen, the account is shown a "select a team" step (mirroring how apps like Notion resolve their own multi-workspace ambiguity). The chosen team is baked into the issued access token and used for every subsequent request — no header needed. Accounts with exactly one team skip this step entirely.

Available tools

Contacts and segments

list_contacts, get_contact, create_contact, update_contact, delete_contact
add_contact_tag, remove_contact_tag, get_contact_deliveries
list_segments, get_segment, create_segment, update_segment, delete_segment

Segments save reusable filters over contact fields, tags, subscription state, signup date, and custom fields.

Templates and media

list_system_templates, list_templates, get_template, create_template, update_template, duplicate_template, delete_template
list_media, get_media, update_media, delete_media, list_media_references

Templates and media are scoped to the selected team. Template list tools accept an optional purpose filter; create_template requires a purpose and returns the computed requiredVariables. System templates expose transactional variable descriptions and examples, but are starters rather than team-owned sendable templates. Use duplicate_template to copy or safely convert one.

Template and sequence-email content is validated as a complete SendLit email document on every write. The style must include colors, typography.header, typography.text, typography.link, interactives, and structure; blocks must be one of text, link, image, separator, or footer. Metadata supports only optional previewText and an optional utm object with source, medium, and campaign strings. For AI-created content, start with list_system_templates and duplicate_template rather than constructing a document shape from scratch.

Broadcasts and sequences

Broadcasts use the sequence resource with one email and an audience filter. Sequence tools include:

list_sequences, get_sequence, create_sequence, update_sequence
add_sequence_email, update_sequence_email, delete_sequence_email
start_sequence, pause_sequence, get_sequence_stats, get_sequence_subscribers

Use start_sequence only after the audience, trigger, email content, delays, and optional tag actions are correct. Use pause_sequence to stop future sequence processing.

Transactional email

send_email sends one API-triggered email.
get_email retrieves one delivery record.
list_emails lists transactional delivery records.

Transactional sends are separate from broadcasts and sequences; they do not enroll a contact or use a campaign audience. send_email accepts only team-owned transactional templates and reports template_not_transactional or the missing variable paths without creating a send. Broadcast and sequence tools accept only marketing templates and report template_not_marketing.

Sending configuration

get_general_settings, update_general_settings
get_esp_config, update_esp_config, delete_esp_config, send_test_email
list_esps, create_esp, get_esp, update_esp, delete_esp, test_esp

The ESP tools manage the team’s sending providers and default provider. Secrets are accepted for writes but are not returned in read responses.

Teams and API keys

list_teams, create_team, rename_team, delete_team
list_api_keys, create_api_key, delete_api_key

The full API key secret is returned only by create_api_key. Store it immediately; it cannot be recovered from a later listing.

Delivery feedback and suppressions

get_esp_feedback_connection, upsert_esp_feedback_connection, test_esp_feedback_connection, delete_esp_feedback_connection
list_delivery_events, get_delivery_event
list_suppressions, get_suppression, release_suppression

Delivery-feedback connections are supported only for providers with a reviewed asynchronous feedback adapter. Releasing a SendLit suppression does not remove a provider-native suppression, and complaint suppressions are not releasable through the owner API.

Example client configuration

The exact configuration shape depends on the MCP client. For clients that support a URL-based MCP server entry, use:

{
    "mcpServers": {
        "sendlit": {
            "url": "https://api.sendlit.app/mcp",
            "headers": {
                "x-sendlit-apikey": "${SENDLIT_API_KEY}"
            }
        }
    }
}

Prefer the client’s secure secret-store or environment-variable mechanism. Do not paste a live API key into a checked-in configuration file.

Operational limits

The MCP endpoint is rate limited to 60 requests per minute. A missing or invalid credential returns an HTTP 401 response; an unknown Mcp-Session-Id returns an MCP session-not-found error. Start a new MCP session when a client’s session has expired or been closed.

On this page