Kit’s API v4 is the modern REST API for programmatic access to subscribers, tags, forms, sequences, broadcasts, and Kit Commerce. Simple API key authentication, JSON payloads, generous rate limits (600 requests per minute per API key), well-documented webhook subscriptions. What Kit does NOT ship in 2026: an official Model Context Protocol server. AI-agent access comes from community MCP wrappers rather than first-party — unusual for a modern ESP but consistent with Kit’s small engineering team and creator-first positioning.
Model Context Protocol is the emerging standard for connecting LLM agents to external tools. Kit has not yet shipped a first-party MCP server, which is notable given the creator community’s early enthusiasm for AI workflows. Community wrappers fill the gap for now.
Kit has not shipped an official Model Context Protocol server as of August 2026. Given Kit’s small engineering team and creator-first positioning, it may not be a near-term priority. AI-agent access currently comes from two community routes: the aplaceforallmystuff/mcp-kit community MCP (self-hosted, covers subscribers/broadcasts/sequences) and Kit MCP via mcpmarket (commercial hosted). Both are functional but neither is Kit-endorsed.
Most-active community MCP for Kit. Self-hosted. Manage subscribers, tags, broadcasts, sequences via Claude Desktop natural language.
Commercial hosted Kit MCP. Managed authentication, prompt injection defense, observability layer. Pay-per-use pricing.
Bridge access via Zapier’s MCP layer. Useful if you already run Zapier for other creator tools.
| Base URL | https://api.kit.com/v4 |
|---|---|
| Response format | JSON |
| Authentication | API key (header: X-Kit-Api-Key) or OAuth 2.0 for public apps |
| Rate limits | 600 requests per minute per API key |
| Response on rate exceed | HTTP 429 with Retry-After header |
| Pagination | Cursor-based via after and before query params (max page size 500) |
| Webhook events | Subscriber events (subscribe, unsubscribe, tag added, purchase) |
| Legacy v3 status | Deprecated. Migrate to v4. |
Simplest and most common for internal use. Generate an API key in your Kit account under Account › Settings › Advanced › API. Send it in the request header:
X-Kit-Api-Key: YOUR_API_KEY Content-Type: application/json Accept: application/json
API keys are account-scoped and inherit full account permissions. No granular scopes — a token can do anything the account allows. Rotate keys promptly if compromised.
Required for third-party apps published in the Kit integration marketplace. Standard three-leg authorization code flow. Register your app in the Kit Developer Portal. Access tokens have long lifetimes; no refresh required for most use cases.
| Limit type | Value | Notes |
|---|---|---|
| General requests | 600 per minute | Per API key. Generous for creator use cases. |
| Response on exceed | HTTP 429 | Includes Retry-After header with wait time in seconds. |
| Bulk operations | Batch endpoints available for subscriber operations | Preferred over looping single-subscriber calls. |
| Webhook payload size | Not disclosed | Standard SaaS conventions apply. |
The 600 req/min per API key ceiling is generous for typical creator workflows. Only large-scale migrations (100K+ subscribers moving in a batch) push near the limit — use batch endpoints for bulk operations.
| Language | Package | Install | Status |
|---|---|---|---|
| PHP | convertkit/api-client | composer require | Official |
| Node.js | @kit/api-client | npm install | Official |
| Python | Community wrappers | pip install | Community |
| Ruby | Community wrappers | gem install | Community |
Kit’s official SDK footprint is thin (2 official). For Python, Ruby, .NET, and other languages, community wrappers exist but quality varies. Direct API calls with your language’s HTTP client are often safer than an unmaintained community SDK.
| Resource | HTTP methods | Description |
|---|---|---|
| Subscribers /subscribers | GET, POST, PATCH, DELETE | Full CRUD on subscribers. Bulk import via batch endpoints. |
| Tags /tags | GET, POST, PATCH, DELETE | Manage subscriber tags. Add/remove tags on subscribers via tag membership endpoints. |
| Custom fields /custom_fields | GET, POST, PATCH, DELETE | Custom subscriber fields for enrichment (name, phone, custom text). |
| Forms /forms | GET, POST, PATCH | Signup forms and their submissions. Add subscribers via form subscription endpoint. |
| Sequences /sequences | GET, POST | Automated email sequences. Add subscribers to sequences via subscription endpoint. |
| Broadcasts /broadcasts | GET, POST, PATCH, DELETE | One-off newsletter broadcasts. Schedule, send, get reports. |
| Purchases /purchases | GET, POST | Track purchases (from Kit Commerce or external ecommerce). Trigger post-purchase sequences. |
| Webhooks /webhooks | GET, POST, DELETE | Configure webhook subscriptions for subscriber events. |
const axios = require('axios');
const API_KEY = 'YOUR_API_KEY';
const BASE_URL = 'https://api.kit.com/v4';
async function subscribeWithTag(email, tagId) {
// 1. Create subscriber
const created = await axios.post(
`${BASE_URL}/subscribers`,
{
email_address: email,
first_name: 'Alaa',
state: 'active'
},
{ headers: { 'X-Kit-Api-Key': API_KEY } }
);
// 2. Add tag
await axios.post(
`${BASE_URL}/tags/${tagId}/subscribers`,
{ email_address: email },
{ headers: { 'X-Kit-Api-Key': API_KEY } }
);
console.log(`Subscribed and tagged: ${created.data.subscriber.id}`);
}
subscribeWithTag('user@example.com', 'YOUR_TAG_ID');Kit’s legacy API v3 is deprecated. New development targets v4 at api.kit.com/v4. Note that v4 uses X-Kit-Api-Key header (not v3’s api_secret query parameter).
Kit API keys grant full account access. No read-only or object-scoped tokens. For safer third-party integrations, rotate keys on staff turnover and limit key distribution.
You can subscribe/unsubscribe subscribers to existing sequences via the API. Creating or modifying sequence content is UI-only.
Only PHP and Node.js official SDKs. For Python, Ruby, .NET, community wrappers vary in quality. Audit maintenance status before adopting a community SDK, or call the API directly with your language’s HTTP client.
No. Kit does not ship a first-party MCP server as of August 2026. Community coverage: aplaceforallmystuff/mcp-kit (self-hosted, most-active) or Kit MCP via mcpmarket (commercial hosted).
Two officially maintained SDKs: PHP and Node.js. For Python, Ruby, .NET, community wrappers exist but quality varies. Audit maintenance status before adopting a community SDK.
600 requests per minute per API key. Generous for creator use cases. HTTP 429 includes Retry-After header. Use batch endpoints for bulk operations.
API key in the X-Kit-Api-Key header. Generate under Account › Settings › Advanced › API. Account-scoped, no granular permissions. For public apps: OAuth 2.0 with app registration in Kit Developer Portal.
Deprecated. Migrate to v4 at api.kit.com/v4. Note that v4 uses X-Kit-Api-Key header (v3 used api_secret query parameter).
Yes, via community MCP. Install aplaceforallmystuff/mcp-kit (self-hosted) or subscribe to Kit MCP via mcpmarket. Both let AI agents manage subscribers, tags, broadcasts, sequences through natural language.
No. Sequences are UI-only for creation and content editing. The API lets you subscribe/unsubscribe subscribers to existing sequences, but sequence creation requires the Kit dashboard.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.