Resend API + MCP (2026): dev-first REST, OAuth 2.1 and hosted MCP

Resend ships one of the tightest developer stories in the ESP market: a single JSON REST base at api.resend.com, 10 first-party SDKs kept on the same release cadence, and a first-party remote MCP server at mcp.resend.com/mcp that installs into Claude, Cursor, Codex and GitHub Copilot in one click. If your evaluation shortlist includes Postmark, Mailgun or Amazon SES, Resend is the option that treats the API and the AI-agent surface as the primary product rather than a bolt-on.

This tab is the API and MCP reference for buyers, platform engineers and AI-agent integrators. It covers the authentication model (Bearer plus OAuth 2.1 with PKCE), the 10 requests/second per-team rate limit, the 19 documented endpoint groups, the official SDK matrix, canonical Python and Node snippets, five gotchas Resend teams hit in production, and the recent changelog events that actually change how you integrate.

At a glance

MCP integration in 2026

Resend is one of the very few transactional ESPs that treats Model Context Protocol as a first-party surface rather than a community experiment. The hosted server exposes almost the entire REST API to any MCP client, and the same code ships as an open-source npm package for teams that need to run it inside their own VPC.

Available MCP servers

Two official surfaces (hosted and self-run), one containerized distribution in the Docker MCP Catalog, and a small community layer.

Resend API essentials

The Resend REST API is a single, unversioned surface today. Every path lives under one base URL, every response is JSON, and Resend has publicly committed to calendar-based header versioning rather than URL path bumps, so integration code written today should not break at the next major release.

The API is organized around 19 resource groups covering transactional email, batch send, inbound routing, broadcasts, contacts, segments, topics, templates, domain verification, API keys, suppressions, webhooks, request logs and OAuth. That coverage is comparable to Postmark‘s server-oriented surface while pulling in marketing primitives (segments, topics, broadcasts) that are typically split between two products at legacy vendors.

Authentication methods

Resend offers two authentication modes. Bearer tokens are the default for server-to-server integrations; OAuth 2.1 with PKCE is the newer flow purpose-built for third-party apps and AI agents that must not hold static credentials.

Bearer API key

Every API request must carry an Authorization: Bearer re_xxxxxxxxx header. API keys are created under Settings › API Keys, are scoped to a single team, and support two permission tiers: Full access and Sending access (send-only, no key/domain management). Keys are shown once at creation and never again, store them in a secret manager immediately.

curl https://api.resend.com/emails 
  -H "Authorization: Bearer re_xxxxxxxxx" 
  -H "Content-Type: application/json" 
  -d '{
    "from": "Acme <onboarding@resend.dev>",
    "to": ["delivered@resend.dev"],
    "subject": "Hello from Resend",
    "html": "<strong>It works</strong>"
  }'

OAuth 2.1 with PKCE

Since July 13, 2026 Resend supports OAuth 2.1 + PKCE with dynamic client registration, exposed under /oauth/*. This is the recommended path when a third-party app, an AI agent, or a Claude MCP connector needs delegated access to a Resend team without long-lived API keys. The flow follows the standard: register a client, redirect the user to Resend for consent, exchange the code + PKCE verifier for a scoped access token, and refresh silently.

Rate limits

Resend publishes a single per-team default with headroom available on request. The cap is enforced at the team level, not per API key, which is a common surprise for teams that assume sharding keys will multiply throughput.

Workaround pattern. Every response carries ratelimit-remaining and retry-after headers. The standard shape is a client-side queue (Cloudflare Queues, Upstash QStash, Trigger.dev, Inngest) that dispatches sends at a steady 8-9 req/sec, catches 429s and backs off with jitter. Batch sends via /emails/batch collapse 100 sends into a single request and are the fastest way to stay under the ceiling for bulk workloads. If you need a per-hour ceiling higher than 36,000 theoretical calls, open a support request. Resend does raise the cap for verified teams.

Official SDKs

Resend maintains 10 first-party SDKs under the github.com/resend org, all versioned in lock-step with the REST API. The Node.js SDK is the primary reference; Laravel and the Vercel AI Chat SDK adapter deserve special mention because they wire Resend into the framework’s own abstractions (mail transport and streaming chat, respectively) rather than exposing a raw client.

Notable community SDKs

Because Resend publishes a machine-readable OpenAPI spec, community SDKs auto-generate cleanly. Search for resend- on npm, PyPI and crates.io. Notable third-party wrappers include Deno-first HTTP clients, Elixir libraries, and Cloudflare Workers helpers. When picking a community SDK, verify the last commit is within 90 days and that it tracks the current OpenAPI hash, stale wrappers often miss the newer /broadcasts, /segments, /topics and /contact-properties resources.

Endpoints reference

The full REST surface exposes 19 resource groups. Reference paths are relative to the base URL https://api.resend.com. The canonical documentation lives at resend.com/docs/api-reference.

Code examples

Two canonical snippets: send a transactional email and add a contact to an audience. Both patterns transfer directly to the other 10 official SDKs; only the client instantiation differs.

Python (resend package)

# pip install resend
import os
import resend

resend.api_key = os.environ["RESEND_API_KEY"]

# 1) Send a transactional email
params: resend.Emails.SendParams = {
    "from": "Acme <onboarding@resend.dev>",
    "to": ["delivered@resend.dev"],
    "subject": "Hello from Resend",
    "html": "<strong>It works</strong>",
}
email = resend.Emails.send(params)
print("sent:", email["id"])

# 2) Add a contact to an audience
contact = resend.Contacts.create({
    "audience_id": "aud_xxxxxxxx",
    "email": "reader@example.com",
    "first_name": "Alaa",
    "unsubscribed": False,
})
print("contact:", contact["id"])

Node.js / TypeScript (resend package)

// npm install resend
import { Resend } from 'resend';

const resend = new Resend(process.env.RESEND_API_KEY);

async function main() {
  // 1) Send an email
  const { data, error } = await resend.emails.send({
    from: 'Acme <onboarding@resend.dev>',
    to: ['delivered@resend.dev'],
    subject: 'Hello from Resend',
    html: '<strong>It works</strong>',
  });
  if (error) return console.error(error);
  console.log('sent id:', data.id);

  // 2) Create a contact
  const contact = await resend.contacts.create({
    audienceId: 'aud_xxxxxxxx',
    email: 'reader@example.com',
    firstName: 'Alaa',
    unsubscribed: false,
  });
  console.log('contact id:', contact.data?.id);
}

main();

Common gotchas

Deprecations and changelog

Resend maintains a public, dated changelog. The events below materially change how you integrate as of August 2026.

• August 18, 2026-Broadcasts API adds a cancel endpoint. Scheduled or queued broadcasts can now be cancelled directly via the API instead of only through the dashboard.
• August 13, 2026-Resend adopts the Agent Plugins Standard, streamlining one-click MCP install across Claude, Cursor, Codex, Devin and GitHub Copilot.
• August 6, 2026-The remote MCP server at mcp.resend.com/mcp now supports the stateless MCP protocol.
• July 16, 2026-Automatic secret scanning: exposed re_ API keys committed to GitHub are detected, revoked and reported to the owning team.
• July 13, 2026–OAuth 2.1 with PKCE released for building authenticated third-party Resend apps.
• July 11, 2026-One-click Resend connector added to the Claude connector directory.

Full history at resend.com/changelog.

Frequently asked questions