Sender.net API + MCP (2026): first-party server, v2 REST, two SDKs

Sender.net exposes one versioned REST API at https://api.sender.net/v2/, authenticated with a Bearer token, covering eleven resource families from subscribers and groups through campaigns, workflows and transactional sends. First-party transactional SDKs ship for PHP and Node.js/TypeScript plus a hosted browser JavaScript SDK, no official Python, Go or Ruby client. The 2026 headline is a genuine first-party remote MCP server at https://mcp.sender.net/mcp with roughly 40 OAuth-scoped tools, putting Sender ahead of MailerLite and EmailOctopus on agent tooling.

At a glance

MCP integration in 2026

MCP is how an AI client. Claude, ChatGPT, Cursor, gets structured, permissioned access to a SaaS account instead of scraping a dashboard or holding a raw API key. For an ESP the practical questions are whether the vendor runs its own server, what the tool surface reaches, and what stops a model from mailing a real list by accident.

The guardrails are stricter than most vendor MCP servers. Campaigns created through MCP stay drafts; workflows stay inactive until an explicit activate_workflow call that only succeeds after validate_workflow passes; destructive actions require an acknowledgment flag; and the server inherits your plan and permission limits. One deliberate omission: no transactional send tool is exposed over MCP. Mail still leaves through the REST API or the smtp.sender.net relay-an agent that drafts a campaign but cannot fire it is a materially different risk profile.

Available MCP servers

Three MCP surfaces reach Sender in 2026, two of Sender’s own, plus a third-party wrapper through Zapier.

Sender.net API essentials

The API is a conventional JSON REST surface. Every request goes over HTTPS, plain HTTP is not supported and does not fall back, and every authenticated call carries an Authorization: Bearer header. There is one live version, v2, with no published v1 sunset or v3 roadmap.

Sender returns has_more_resources as a boolean alongside meta.last_page, which makes a while-loop safe without arithmetic on page counts. A documented call reads https://api.sender.net/v2/campaigns?page=5&limit=20&order=modified&direction=desc. The order parameter takes a field key on the listed resource, not a fixed enum. Neither the default nor the maximum limit is published, read meta.per_page back from the first response rather than hard-coding one.

Authentication methods

Sender runs three separate credential systems and none is interchangeable with the others. Confusing them is the most common failure mode on new accounts.

REST API: Bearer access token

Create a token under Account settings → API access tokens and send it as Authorization: Bearer {API_ACCESS_TOKEN}. Tokens are account-scoped, not per-resource, so any token reaches any endpoint your plan permits. All tokens on an account share one rate-limit window, issuing separate tokens buys revocation granularity, not extra throughput.

SMTP relay: generated username and one-time password

The relay at smtp.sender.net authenticates with SMTP AUTH PLAIN or LOGIN over TLS, using a pair created under Transactional emails → Setup instructions → SMTP → Add SMTP user. You pick a base name and Sender appends a random suffix, producing handles such as Gabrielle_e736w1. It is never your account email, and never the literal string apikey. See the SMTP settings tab for the port and TLS matrix.

MCP server: OAuth 2 with scope mcp:use

The MCP server does not accept the REST Bearer token. It runs a full OAuth 2 flow with browser consent on scope mcp:use, advertised via RFC 9728 metadata at /.well-known/oauth-protected-resource. In practice: add https://mcp.sender.net/mcp as a custom connector in Claude, enable developer mode in ChatGPT, or drop an mcpServers entry into a Cursor config, then approve the consent screen. Access is revocable from the dashboard without rotating your API token.

Rate limits

Sender deliberately publishes no fixed numeric rate limits. Limits are enforced per minute and tracked per account, every token on the account shares one window, and the value in force for your account is returned on every response.

Treat the headers as the contract. Read X-RateLimit-Limit at startup to size your worker pool, decrement against X-RateLimit-Remaining in-process, and on a 429 sleep for exactly the Retry-After value rather than a generic exponential backoff, the server is telling you the precise reset. Because the window is per account, a batch import running beside a live transactional stream starves it: schedule bulk subscriber work outside your send windows. For hard throughput guarantees, pair Sender with a dedicated transactional provider.

Official SDKs

Sender maintains two server-side packages, both transactional-only. Neither wraps the campaign, subscriber, group or workflow endpoints, those take plain HTTP calls. A narrower SDK story than Brevo offers, and the reason most Sender integrations end up as thin hand-rolled clients.

The PHP package (last updated December 9, 2025) ships a fluent EmailParams builder, typed exceptions and a first-class Laravel mail transport, that transport is the strongest reason to prefer it over raw cURL. The Node package (June 8, 2026) is TypeScript-first with a chainable SenderClient().email() builder. The browser SDK is a hosted script, not an npm package, covering custom event tracking and signup-form rendering.

Notable community SDKs

Sender curates no community SDK list, and no third-party client for Python, Go or Ruby has emerged with meaningful download volume as of August 2026. The practical substitutes are the official Zapier app, the WordPress and WooCommerce plugins, and the PrestaShop module in the sendernet GitHub organisation, last updated August 4, 2026. Anything else is hand-written, no OpenAPI spec is published.

Endpoints reference

The table maps what the v2 API reaches. Read it as a map rather than copy-pasteable routes: only a handful of paths are confirmed verbatim, and Sender’s docs render resource pages dynamically. Verify any sub-path you depend on against the official API reference before shipping.

Code examples

Send a transactional email with Python

No official Python SDK exists, so this hits /v2/message/send with requests. The from address must sit on a domain already verified with SPF, DKIM and DMARC green, or the call is rejected.

import requests

url = "https://api.sender.net/v2/message/send"

headers = {
    "Authorization": "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json",
    "Accept": "application/json",
}

payload = {
    "from": "hello@yourverifieddomain.com",
    "to": "user@example.com",
    "subject": "Welcome to Acme",
    "html": "<h1>Hi {{name}}</h1><p>Thanks for signing up.</p>",
    "variables": {"name": "Alaa"},
}

response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.json())

# Rate limiting: read X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset.
# On HTTP 429, back off for the number of seconds in the Retry-After header.

Send with the official Node.js SDK

The TypeScript client wraps the same endpoint with a chainable builder. The commented block underneath is the equivalent plain fetch call, what you write on any stack without an official package.

import { SenderClient } from '@sendernet/sender-transactional-nodejs';

const client = new SenderClient({ apiKey: process.env.SENDER_API_TOKEN });

const response = await client.email()
  .from('hello@yourverifieddomain.com', 'Acme')
  .to({ email: 'user@example.com', name: 'Alaa Touil' })
  .subject('Welcome {{name}}!')
  .text('Thank you for signing up, {{name}}!')
  .variables({ name: 'Alaa Touil' })
  .send();

console.log('Email sent:', response.messageId);

// Plain fetch equivalent, no SDK:
// await fetch('https://api.sender.net/v2/message/send', {
//   method: 'POST',
//   headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
//   body: JSON.stringify({ from, to, subject, html }),
// });

Register the MCP server in Cursor

No key goes in the config. The first tool call triggers the OAuth consent flow in the browser; the token is then held by the client and revocable from the Sender dashboard.

{
  "mcpServers": {
    "sender": {
      "url": "https://mcp.sender.net/mcp"
    }
  }
}

In Claude, add the same URL as a custom connector under Customize → Connectors; in ChatGPT, enable developer mode and add it as a remote MCP connector. Any client supporting remote MCP with OAuth 2 works.

Common gotchas

Deprecations and changelog

Sender publishes no dated release-notes feed for the API. The timeline below is assembled from Product Update posts on Sender’s blog and public repository activity in the sendernet GitHub organisation.

• August 4, 2026-The PrestaShop module repository (sendernet/senderautomatedemails) received its most recent public update.
• June 8, 2026-Official Node.js/TypeScript transactional SDK @sendernet/sender-transactional-nodejs last published: a TypeScript-first builder API wrapping /v2/message/send.
• March 2026-Product Update: ecommerce reports extended to Standard, the Shopify API integration upgraded, new transactional templates shipped, custom event tracking announced.
• December 9, 2025-Official PHP transactional SDK sendernet/sender-transactional-php last updated, adding a fluent EmailParams builder, typed exceptions and a native Laravel mail transport.
• As of August 19, 2026-The MCP server is live at https://mcp.sender.net/mcp with roughly 40 OAuth-scoped tools, presented as GA rather than beta. No dated launch entry is published.

No v2 endpoint has been announced as deprecated and no v1 sunset date exists publicly. Watch the official API reference and the help center-neither carries an RSS feed or a versioned changelog.

Frequently asked questions