AWeber API + MCP (2026): v3 OAuth + Zapier MCP Bridge
AWeber’s API v3 is a mature REST API with OAuth 2.0 authentication, JSON payloads, and documented rate limits (60 requests per minute per token). SDK footprint is thin (community wrappers for most languages), and there is no official Model Context Protocol server as of 2026. AWeber has invested more in AI writing tools within its UI than in developer/MCP infrastructure, consistent with its SMB positioning since 1998.
At a glance
Current API version
OAuth 2.0-based, v2 deprecated
Official SDKs
Community wrappers only (PHP, Python, Node.js, Ruby)
Official MCP server
Zapier MCP bridge available
MCP integration in 2026
Model Context Protocol is the standard for connecting LLM agents to external tools. AWeber has not shipped a first-party MCP server as of August 2026, consistent with its focus on SMB marketing UI rather than developer infrastructure.
No official AWeber MCP, use Zapier MCP bridge or community wrappers
AWeber has not shipped a first-party Model Context Protocol server. For AI-agent access, the primary route is the Zapier MCP layer which bridges AWeber through Zapier’s 9,000+ integration ecosystem. Community MCP wrappers for the AWeber API v3 exist on GitHub but are less mature than for Kit, Mailchimp, or Klaviyo. AWeber has instead invested in its native AI Writing Assistant (subject lines, content ideas) within the UI.
Available MCP options for AWeber
Access AWeber via Zapier’s MCP layer (9,000+ integrations bridged). Managed authentication through Zapier OAuth. Pay-per-task credits.
Community-maintained MCP wrappers exist on GitHub. Quality and maintenance vary, audit last-commit date before adopting for production use.
API v3 essentials
| Base URL | https://api.aweber.com/1.0 |
|---|---|
| Response format | JSON |
| Authentication | OAuth 2.0 three-leg flow (Client ID + Client Secret + access token) |
| Rate limits | 60 requests per minute per access token |
| Access token lifetime | 1 hour (auto-refresh via refresh token) |
| Refresh token | Long-lived, rotates on refresh |
| Pagination | Offset-based with ws.start and ws.size query params |
| Response on rate exceed | HTTP 403 (not 429, unusual) |
| Legacy API v1/v2 | Deprecated. All new development targets v3. |
Authentication methods
OAuth 2.0 (only option)
Register your app at labs.aweber.com to get Client ID + Client Secret. Implement three-leg authorization code flow to obtain access tokens on behalf of AWeber users.
GET https://auth.aweber.com/oauth2/authorize ?client_id=YOUR_CLIENT_ID &redirect_uri=YOUR_REDIRECT_URI &response_type=code &scope=account.read+list.read+subscriber.write
Access tokens expire after 1 hour. Refresh tokens rotate on each refresh, always store the newest refresh token from every refresh response.
Rate limits
| Limit type | Value | Notes |
|---|---|---|
| General requests | 60 per minute | Per access token. Enforced per user OAuth session. |
| Response on exceed | HTTP 403 (not 429) | Unusual, most APIs return 429. Implement backoff on 403 responses. |
| Bulk operations | Batch endpoints available | Use for bulk subscriber imports and updates. |
| Webhook payload size | Not disclosed | Standard SaaS conventions apply. |
Official SDKs
AWeber does NOT ship official SDKs. Community wrappers exist for PHP, Python, Node.js, and Ruby but quality varies. For production use, either audit community SDK maintenance carefully or call the API directly with your language’s HTTP client, the OAuth flow is standard and API responses are straightforward JSON.
Endpoints reference
| Resource | HTTP methods | Description |
|---|---|---|
| Accounts /accounts | GET | Read account details and access lists within the account. |
| Lists /accounts/{id}/lists | GET | List all AWeber lists in the account. List creation is UI-only. |
| Subscribers /accounts/{id}/lists/{list_id}/subscribers | GET, POST, PATCH, DELETE | Full CRUD on subscribers. Batch endpoint for bulk imports. |
| Tags /accounts/{id}/lists/{list_id}/subscribers/{id}/tags | GET, POST, DELETE | Manage tags on subscribers. |
| Broadcasts /accounts/{id}/lists/{list_id}/broadcasts | GET, POST, PATCH, DELETE | Manage broadcast emails. Schedule, cancel, get stats. |
| Custom fields /accounts/{id}/lists/{list_id}/custom_fields | GET, POST, PATCH, DELETE | Custom subscriber fields. |
| Reports /accounts/{id}/reports | GET | Aggregate reports on broadcasts and subscriber engagement. |
Code examples
Python: add subscriber via API v3
import requests
ACCESS_TOKEN = 'YOUR_ACCESS_TOKEN'
ACCOUNT_ID = 'YOUR_ACCOUNT_ID'
LIST_ID = 'YOUR_LIST_ID'
url = f'https://api.aweber.com/1.0/accounts/{ACCOUNT_ID}/lists/{LIST_ID}/subscribers'
headers = {
'Authorization': f'Bearer {ACCESS_TOKEN}',
'Content-Type': 'application/json'
}
payload = {
'ws.op': 'create',
'email': 'subscriber@example.com',
'name': 'Alaa Touil',
'tags': ['newsletter', 'signup']
}
response = requests.post(url, json=payload, headers=headers)
print(response.json())Common gotchas
Rate limit returns HTTP 403, not 429
AWeber returns 403 Forbidden when you exceed 60 requests/minute per token, not the standard 429 Too Many Requests. If you build generic rate-limit handling that only checks for 429, AWeber’s 403 rate-limit responses will look like permission errors. Handle both codes.
No official SDKs
Zero officially maintained SDKs. Community wrappers vary in quality. For production, direct HTTP client calls are often safer than an unmaintained community SDK. The API is straightforward REST with standard OAuth 2.0.
Refresh token rotation on every refresh
AWeber rotates the refresh token on every refresh response. If you store only the initial refresh token and never update it, subsequent refreshes fail after the first rotation. Always persist the latest refresh token.
List creation is UI-only
The API can read lists and manage subscribers within them, but cannot create new lists programmatically. New lists must be created via the AWeber dashboard.
Deprecations and changelog
- API v3 is current. OAuth 2.0-based REST API.
- API v1 and v2 deprecated. Migrate to v3 immediately if you have a legacy integration.
- No official MCP server as of 2026. AWeber’s AI investment has focused on the AI Writing Assistant in the UI.
- OAuth 2.0 refresh token rotation introduced for improved security.
Frequently asked questions
Does AWeber have an official MCP server for AI agents?
No. AWeber does not ship a first-party MCP server as of August 2026. Primary AI-agent route: Zapier MCP layer (bridges AWeber through Zapier’s 9,000+ integrations). Community MCP wrappers exist on GitHub but quality varies.
Does AWeber have official SDKs?
No. AWeber ships no official SDKs. Community wrappers exist for PHP, Python, Node.js, and Ruby with varying maintenance quality. For production, direct HTTP client calls with OAuth 2.0 are often safer than unmaintained community SDKs.
What is the AWeber API rate limit?
60 requests per minute per access token. Response on exceed is HTTP 403 Forbidden (unusual, most APIs return 429). Handle both codes in your rate-limit logic.
How do I authenticate with the AWeber API?
OAuth 2.0 only. Register your app at labs.aweber.com for Client ID + Client Secret. Implement three-leg authorization code flow. Access tokens expire after 1 hour; refresh tokens rotate on each refresh, always persist the newest refresh token.
Is the AWeber API v1 or v2 still supported?
Deprecated. All new development must target v3. Legacy v1/v2 integrations should migrate promptly.
Can I send emails through AWeber from Claude Desktop?
Only via Zapier MCP bridge (no first-party AWeber MCP). Community MCP wrappers exist but are less mature than for Kit, Mailchimp, or Klaviyo.
Can I create lists via the AWeber API?
No. List creation is UI-only in AWeber. The API can read lists and manage subscribers within them, but new lists must be created via the AWeber dashboard.
Changelog (recent)
- 2026-08-18 API + MCP tab published on SMTPedia. First profile documenting AWeber API v3 alongside Zapier MCP bridge (no first-party MCP).
- 2026 AWeber AI Writing Assistant matured with subject line generation, content ideas, tone adjustment. No first-party MCP server yet.
- 2024-2025 OAuth 2.0 refresh token rotation introduced for improved security posture.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
