Constant Contact API + MCP (2026): v3 OAuth + Community MCP Coverage

Constant Contact’s API v3 is the modern REST API for programmatic access to contacts, campaigns, tags, activities, and reports. OAuth 2.0 authentication, JSON payloads, per-endpoint rate limits documented publicly, decent SDK ecosystem via community wrappers. What Constant Contact does NOT ship in 2026: an official Model Context Protocol server. AI-agent access comes from community MCP wrappers (BusyBee3333, viasocket) rather than first-party. This tab inventories the API surface, MCP alternatives, and the gotchas SMB developers need to evaluate before committing.

At a glance

MCP integration in 2026

Model Context Protocol is the emerging standard for connecting LLM agents to external tools. Constant Contact does not yet ship a first-party MCP server — unusual for a mature ESP with the market position Constant Contact holds. The gap has been filled by two community and commercial MCP options that cover most Constant Contact operations.

Available MCP servers for Constant Contact

Three ways to reach Constant Contact from an AI agent as of August 2026. None are first-party maintained.

API v3 essentials

Constant Contact’s API v3 follows REST conventions with OAuth 2.0 authentication. The predecessor API v2 is deprecated and pre-2020 integrations must migrate to v3.

API v3 uses OAuth 2.0 exclusively — there are no simple API-key endpoints. Setup takes 15-30 minutes for OAuth configuration, but the security profile is stronger than v2 (which used API keys). If you are used to Mailchimp-style API-key authentication, expect a learning curve on OAuth token refresh handling.

Authentication methods

OAuth 2.0 (only option)

Constant Contact API v3 requires OAuth 2.0. Register an application at v3.developer.constantcontact.com to receive Client ID and Client Secret. Implement the three-leg authorization code flow to obtain access tokens on behalf of Constant Contact users.

# 1. Redirect user to authorization endpoint
GET https://authz.constantcontact.com/oauth2/default/v1/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=contact_data+campaign_data+account_read

# 2. Exchange authorization code for tokens
POST https://authz.constantcontact.com/oauth2/default/v1/token
Authorization: Basic BASE64(CLIENT_ID:CLIENT_SECRET)
grant_type=authorization_code
code=RECEIVED_CODE
redirect_uri=YOUR_REDIRECT_URI

# 3. Use access token in API requests
GET https://api.cc.email/v3/contacts
Authorization: Bearer YOUR_ACCESS_TOKEN

Access tokens expire after 2 hours. Refresh tokens rotate on each refresh — always store the newest refresh token from every refresh response. Losing the refresh token requires re-authorization by the user.

Rate limits

Constant Contact publishes per-endpoint rate limits with two-tier throttling (short-term and daily).

The 10,000 daily / 4-per-second limits are generous for SMB use cases but insufficient for large-scale programmatic workflows (bulk data warehousing, real-time analytics). For those needs, use bulk contact import jobs and cache aggressively client-side.

Official SDKs

Constant Contact ships two official SDKs and endorses community wrappers for other languages.

Constant Contact’s official SDK footprint is thinner than Klaviyo (5 official) or Mailchimp (4 official Marketing). For non-PHP languages, community wrappers exist but quality varies — audit maintenance status and last-commit dates before adopting. Many teams call the API directly with their language’s HTTP client rather than depending on a community SDK that may become abandoned.

Endpoints reference

The endpoint groups you will actually use in production. Full reference at v3.developer.constantcontact.com.

Code examples

Node.js: create a contact and add to a list

const axios = require('axios');

const ACCESS_TOKEN = 'YOUR_ACCESS_TOKEN';
const BASE_URL = 'https://api.cc.email/v3';

async function createContact(email, firstName, listId) {
  // 1. Create contact with list membership
  const response = await axios.post(
    `${BASE_URL}/contacts`,
    {
      email_address: { address: email, permission_to_send: 'implicit' },
      first_name: firstName,
      list_memberships: [listId],
      create_source: 'Account'
    },
    { headers: { Authorization: `Bearer ${ACCESS_TOKEN}` } }
  );

  console.log(`Contact created: ${response.data.contact_id}`);
  return response.data;
}

createContact('user@example.com', 'Alaa', 'YOUR_LIST_ID')
  .catch(err => console.error(err.response?.data || err.message));

PHP: send an email campaign

<?php
require 'vendor/autoload.php';

use GuzzleHttpClient;

$client = new Client(['base_uri' => 'https://api.cc.email/v3/']);
$accessToken = 'YOUR_ACCESS_TOKEN';

// Create schedule for existing campaign
$response = $client->post("emails/{$campaignId}/schedules", [
    'headers' => ['Authorization' => "Bearer {$accessToken}"],
    'json' => ['scheduled_date' => '2026-08-20T14:00:00Z']
]);

echo "Scheduled: " . $response->getBody();

Common gotchas

Deprecations and changelog

Constant Contact maintains developer release notes at v3.developer.constantcontact.com. Key items:

• API v3 is current. Stable OAuth 2.0-based REST API. All new development targets v3.
• API v2 deprecated. Shutoff scheduled — migrate immediately if you have a v2 integration.
• No official MCP server as of 2026. Community MCPs (BusyBee3333, viasocket) fill the gap. Watch for an official announcement in the next 12-18 months given competitor movement.
• OAuth 2.0 refresh token rotation introduced with API v3 for improved security posture.
• Bulk activity endpoints matured over 2024-2025 for async import/export operations.

Frequently asked questions