Transactional email service ActiveCampaign-owned since May 2022
Postmark logo

Postmark API + MCP (2026): First SMTP Provider Shipping Official MCP

Postmark’s Email API v1 has been stable for over a decade, ships 13 official client libraries (more than any competitor in this review), and is the reference implementation for teams that want SMTP relay + rich webhooks + clean logs in a single tightly-scoped surface. Where it differentiates in 2026: Postmark is the first mainstream transactional email provider to ship an official Model Context Protocol server, letting Claude Desktop and Cursor send emails, list templates, and pull delivery stats directly through natural language. This tab inventories the API surface, the MCP capabilities, and the gotchas a buyer needs to evaluate before committing.

At a glance

v1
Current API version
Stable since 2010, no breaking versions since
13
Official SDKs
Node, Python, Ruby, PHP, .NET, Java, Rails + more
1
Official MCP server
4 tools: send, template, list, stats

MCP integration in 2026

Model Context Protocol is the emerging standard for connecting LLM agents to external tools. If you want an AI agent (Claude Desktop, ChatGPT, Cursor, custom OpenAI Agents SDK deployment) to send emails through Postmark, MCP is now the connection layer of choice. Here is where Postmark stands.

Postmark ships an official MCP server — released June 2025

The Postmark MCP Server is maintained by ActiveCampaign (Postmark’s parent) as part of Postmark Labs. Repository: github.com/ActiveCampaign/postmark-mcp. Four core tools cover the most common AI-agent asks: send a transactional email, send with a pre-defined template, list available templates, retrieve email delivery statistics. Stdio transport, Node.js runtime, works with Claude Desktop and Cursor out of the box. First-class support means faster bug fixes than community wrappers and guaranteed alignment with API changes.

Available MCP servers for Postmark

Three ways to reach Postmark from an AI agent as of August 2026, ordered by maturity. The first is official Postmark. The others are bridges through general-purpose MCP layers.

Why Postmark is first to ship official MCP for email. The MCP 2026-07-28 specification made stateless HTTP the default transport, which means MCP servers now scale on ordinary load balancers with cached tool lists. Postmark got in early (June 2025 release, before the spec finalized) with the more constrained stdio transport, which is why the tool count is only 4. Expect the official server to expand as HTTP transport matures — message search, bounce management, and server admin are natural next additions.

Email API v1 essentials

The Postmark Email API follows REST conventions with minimal quirks. Its scope is intentionally narrow: transactional email send and receive, plus supporting resources (templates, sender signatures, webhooks, bounces).

Base URLhttps://api.postmarkapp.com
Response formatJSON only
Request timeoutNot documented (assume standard 30-60s HTTP timeout)
Auth header (server-level)X-Postmark-Server-Token
Auth header (account-level)X-Postmark-Account-Token
Standard email max size10 MB (including attachments)
Batch email endpointPOST /email/batch (up to 500 messages, 50 MB total)
Bulk email endpointPOST /email/batchWithTemplates for template-based bulk
Message stream selectorMessageStream field in JSON body (SMTP header equivalent)
Rate limit responseHTTP 429 (informal enforcement per Postmark docs)

Endpoints are grouped by concern (email, bounces, templates, servers, message streams, domains, sender signatures, statistics, webhooks, suppressions, data removal, inbound rules triggers) with no deep resource nesting. All requests are stateless: authenticate every call with the appropriate token header. No cursor pagination beyond simple count + offset query parameters where lists are returned.

Authentication methods

Two token types, both operating through custom HTTP headers.

Server Token (X-Postmark-Server-Token)

Used for the majority of API calls: sending email, managing templates, reading messages, bounces, and stats for a single Server. Scoped to one Postmark Server (a Server in Postmark parlance is a container for domains, message streams, and tokens). Accessible to Account Owners, Admins, and Server Admins in the Postmark UI. Copy from Server › API Tokens.

Account Token (X-Postmark-Account-Token)

Used for account-level operations: creating new Servers, managing sender signatures, listing domains across all Servers, initiating data removal requests, managing account-wide DMARC monitoring. Restricted to Account Owners and Admins. Copy from Account › API Tokens. Never expose an Account Token to browser code or client-side JavaScript.

Permission scope caveat. Postmark’s tokens do not have granular scopes. A Server Token can do anything the Server allows — send, manage templates, read messages, delete stored activity. If you need finer-grained access (for example, a token that can only send but not read logs), the workaround is to isolate use cases into separate Servers with per-Server tokens. Postmark has hinted at scoped tokens on their roadmap but as of 2026 they are not shipped.

Rate limits

Postmark’s rate-limiting posture is unusually permissive for a modern API: no daily quota, no per-endpoint budget, one loosely-enforced concurrency ceiling.

LimitValueNotes
Concurrent SMTP connections10 per IPSelf-policed. Postmark support docs describe this as “informal” and confirm it is not currently enforced at the load balancer.
HTTP API rate limitNot disclosedHTTP 429 is returned when Postmark deems the request rate excessive. No published per-second, per-minute, or per-hour ceiling.
Batch email size500 messages or 50 MBWhichever hits first. Larger batches must be split client-side.
Standard email size10 MBBody + attachments combined. Batch endpoint has the larger 50 MB payload budget.
Response on exceedHTTP 429Too Many Requests. No Retry-After header documented. Implement exponential backoff.
Undisclosed per-second and per-hour API throughput. Postmark does not publish specific messages-per-second or per-hour caps on the HTTP API either. Their stated stance: “we trust customers to self-police, we watch aggregate abuse patterns.” For sustained high-volume sending (100,000+ emails/month), reach out to Postmark support before scaling — they will assign a dedicated IP ($50/mo) and coordinate warmup rather than throttle you silently.

Official SDKs

Postmark ships one of the deepest official SDK catalogs in transactional email. Thirteen libraries maintained by ActiveCampaign, covering every mainstream language plus specialized adapters for Rails, WordPress, Craft CMS, and Grunt build pipelines.

Language / RuntimePackageInstallRepo
Node.js / TypeScriptpostmarknpm install postmarkGitHub
Pythonpostmark-pythonpip install postmark-pythonGitHub
Rubypostmarkgem 'postmark'GitHub
Ruby on Railspostmark-railsgem 'postmark-rails'GitHub
PHPwildbit/postmark-phpcomposer require wildbit/postmark-phpGitHub
.NETPostmarkInstall-Package PostmarkGitHub
JavapostmarkMaven dependencyGitHub
Craft CMScraftcms/postmarkcomposer require craftcms/postmarkCraft plugin store
CLIpostmark-clinpm i postmark-cli -gGitHub
WordPress pluginpostmark-approved-wordpress-pluginWP plugin repoWordPress.org
Gruntgrunt-postmarknpm install grunt-postmark --saveGitHub
All SDKs actively maintained by ActiveCampaign. Unlike Mailchimp’s official Marketing SDKs (frozen since November 2022), Postmark’s client libraries receive regular updates. The Node.js library sees the most frequent releases; other language SDKs get changes as needed. Community forks exist for Go, Rust, and Kotlin but are not officially endorsed — Postmark’s recommendation for unsupported languages is to call the API directly with your language’s standard HTTP client.

Endpoints reference

The endpoint groups you will actually use in production. Full reference at postmarkapp.com/developer/api covers roughly 100 individual operations across all groups.

ResourceHTTP methodsDescription
Email (single)
POST /email
POSTSend a single transactional or broadcast email with optional MessageStream selector.
Email (batch)
POST /email/batch
POSTSend up to 500 emails in one HTTP call. 50 MB payload limit.
Email with template
POST /email/withTemplate
POSTSend using a pre-defined template with dynamic merge variables. Server-side rendering.
Templates
/templates
GET, POST, PUT, DELETEFull CRUD on email templates. Includes HTML + text bodies, subject line templating.
Servers
/servers
GET, POST, PUT, DELETEAccount-level. Manage Servers (containers for domains + streams + tokens). Requires Account Token.
Message Streams
/message-streams
GET, POST, PATCH, DELETEManage transactional and broadcast streams. Configure per-stream sending caps and subscription management.
Messages (outbound)
/messages/outbound
GETSearch and retrieve sent messages by recipient, date range, tag, status, message ID.
Messages (inbound)
/messages/inbound
GETRetrieve inbound emails routed through Postmark’s inbound processing (Pro and Platform plans).
Bounces
/bounces
GET, PUT, DELETEList, retrieve, and reactivate bounced addresses. Bounce type classification.
Statistics
/stats/outbound
GETAggregate outbound stats: sends, opens, clicks, bounces, spam complaints. Grouped by date, tag, platform.
Domains
/domains
GET, POST, PUTAccount-level. Manage sending domains, verify DKIM, verify Return-Path, request DMARC monitoring.
Sender signatures
/senders
GET, POST, PUT, DELETEIndividual From address verification. Alternative to full domain verification for small setups.
Webhooks
/webhooks
GET, POST, PUT, DELETEConfigure webhooks for 15+ event types: delivery, bounce, spam complaint, open, click, subscription changes.
Suppressions
/message-streams/{id}/suppressions
GET, POST, DELETEPer-stream suppression list management. Add, remove, list suppressed recipients.
Data removal
/data-removals
POST, GETGDPR-style right-to-erasure requests for specific recipients across message history.

Code examples

Two representative snippets covering the most common first-day tasks: send a single email, then send a batch with a template.

Node.js: send a single email

const postmark = require('postmark');

const client = new postmark.ServerClient('YOUR_SERVER_API_TOKEN');

client.sendEmail({
  From: 'sender@yourdomain.com',
  To: 'recipient@example.com',
  Subject: 'Test from Postmark API',
  HtmlBody: '<h1>Hello</h1><p>This is a test.</p>',
  TextBody: 'Hello. This is a test.',
  MessageStream: 'outbound'
}).then(response => {
  console.log(`Sent: ${response.MessageID}`);
}).catch(err => {
  console.error(`Error: ${err.message}`);
});

Python: send a batch with a template

from postmark import PMBatchMail

messages = [
    {
        'From': 'sender@yourdomain.com',
        'To': recipient,
        'TemplateAlias': 'welcome-email',
        'TemplateModel': {
            'name': name,
            'product_url': 'https://yourdomain.com/dashboard'
        },
        'MessageStream': 'outbound'
    }
    for (recipient, name) in [
        ('alice@example.com', 'Alice'),
        ('bob@example.com', 'Bob'),
        # ... up to 500 messages per batch
    ]
]

batch = PMBatchMail(api_key='YOUR_SERVER_API_TOKEN', messages=messages)
result = batch.send()
print(f'Batch sent: {len(result)} messages processed')

Common gotchas

Server Token vs Account Token confusion

The X-Postmark-Server-Token header handles 90% of API calls (send, templates, messages, bounces, stats). The X-Postmark-Account-Token header is for account-level operations only (create Servers, manage domains across Servers). Using the wrong token type returns 401 Unauthorized with a confusing “invalid token” message. Match the token type to the endpoint.

MessageStream defaults to outbound if omitted

If you do not include a MessageStream field in your JSON body, Postmark routes through the default outbound transactional stream. This is usually what you want for password resets and receipts, but it silently pollutes reputation if you meant to send a broadcast. Always set MessageStream explicitly for anything that goes to a list.

Batch endpoint returns per-message status, not overall pass/fail

POST /email/batch returns HTTP 200 even if all 500 messages inside failed to queue. Individual message status is in each entry of the response array. Check ErrorCode per message — not the top-level HTTP status — to detect failures. First-time batch users often assume 200 means everything sent.

Tokens do not have granular scopes

A Server Token can do everything the Server allows: send, read logs, manage templates, delete stored activity. There is no “send-only” scope. If you need finer control (e.g. a token for a third-party integration that should not read your customer emails), the workaround is to isolate that integration into its own Server with its own token.

Rate limits are informal — support may pause you without warning

Postmark does not publish concrete per-second or per-hour ceilings, and does not enforce them at the load balancer. What they DO enforce is aggregate abuse patterns (elevated spam complaints, sudden volume spikes on unwarmed IPs, high bounce rate). Persistent bad behavior triggers manual account review — sometimes hours-long pauses. If you are planning a 10x volume spike, email Postmark support first.

Deprecations and changelog

Postmark maintains a public changelog and release notes on the Updates page. Key items to know:

  • Email API v1 is current. No successor announced. No breaking version bumps since 2010 — unusual stability for an API of this age.
  • Postmark MCP Server released June 2025 (Postmark Labs) as the first official MCP for transactional email. Expanded scope expected as MCP HTTP transport matures per the 2026-07-28 spec.
  • SDK maintenance cadence: Node.js library sees regular releases. Other language SDKs update as needed — no frozen SDKs equivalent to Mailchimp’s 2022 pause.
  • Message Streams generally available since 2020. Older accounts still have a legacy single-stream setup by default — migrate to streams for reputation isolation between transactional and broadcast traffic.
  • DMARC monitoring add-on released 2024 in response to Gmail/Yahoo/Microsoft bulk-sender rules. $14/mo per domain, parses aggregate reports into a dashboard.

Frequently asked questions

Does Postmark have an official MCP server for AI agents?

Yes. The Postmark MCP Server, maintained by ActiveCampaign as part of Postmark Labs, is available at github.com/ActiveCampaign/postmark-mcp. Four tools: send transactional email, send with template, list templates, retrieve delivery stats. Released June 2025. Stdio transport, Node.js runtime, compatible with Claude Desktop, Cursor, and any MCP-aware client. Postmark is the first mainstream transactional email provider to ship an official MCP.

Which programming languages have official Postmark SDKs?

Eleven official language/runtime SDKs: Node.js/TypeScript, Python, Ruby, Rails, PHP, .NET, Java, plus specialized integrations for Craft CMS, WordPress plugin, CLI, and Grunt. All maintained by ActiveCampaign. No official SDK for Go, Rust, Kotlin, or Swift — recommendation for those is to call the API directly with your language’s HTTP client. Postmark’s SDKs are actively maintained (unlike Mailchimp’s official Marketing SDKs, frozen since November 2022).

What is the Postmark API rate limit?

Officially: 10 concurrent SMTP connections per IP, self-policed. HTTP API returns 429 Too Many Requests when Postmark deems request rate excessive, but no per-second or per-hour ceiling is published. Postmark’s stance is “we trust customers to self-police, we watch aggregate abuse patterns.” For sustained high-volume sending (100k+/month), contact support to coordinate a dedicated IP ($50/mo) and warmup plan.

How do I authenticate with the Postmark API?

Two HTTP header tokens. X-Postmark-Server-Token for server-level operations (send, templates, messages, bounces, stats) — scoped to one Postmark Server. X-Postmark-Account-Token for account-level operations (create Servers, manage domains across Servers, data removal requests). Tokens do not have granular scopes; isolate access by splitting into separate Servers if you need finer control.

What is the difference between Server Token and Account Token?

A Server Token grants access to one specific Postmark Server (a Server is a container for domains, message streams, tokens, and templates). Use it for 90% of API calls including all send operations. An Account Token grants access to account-level operations across all your Servers: creating new Servers, managing domains globally, initiating GDPR data removal requests, managing DMARC monitoring. Only Account Owners and Admins can create Account Tokens. Never expose an Account Token in client-side code.

Can I send emails through Postmark from Claude Desktop or Cursor?

Yes. Install the official Postmark MCP Server and add it to your Claude Desktop or Cursor config. Configure with a Postmark Server Token, default sender email, and default message stream. Once loaded, you can prompt “Send a test email to team@example.com about tomorrow’s deployment” and the agent dispatches through your Postmark infrastructure. Four tools available: send, send with template, list templates, get stats.

Are Postmark’s rate limits actually enforced?

The published 10-concurrent-connection ceiling is not currently enforced at the load balancer per Postmark’s own support documentation. What IS enforced is aggregate abuse pattern detection: elevated spam complaints, sudden volume spikes on unwarmed IPs, high bounce rate. Persistent bad behavior triggers manual account review, sometimes with account pauses lasting hours. Clean senders effectively see no rate limits — Postmark’s stance is “self-policing plus aggregate watching.”

Changelog (recent)

  • 2026-08-17 API + MCP tab published on SMTPedia. First profile to inventory Postmark's official MCP server against community wrappers.
  • 2026-07-28 MCP specification 2026-07-28 released. Stateless HTTP transport becomes default, enabling MCP servers to scale on ordinary load balancers.
  • 2025-06 Postmark MCP Server released by ActiveCampaign under Postmark Labs. First official MCP for a mainstream transactional email provider.
AAlaa Touil RRabeb How we test →

This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.