SocketLabs API + MCP (2026): two gateways, zero MCP servers

SocketLabs runs two HTTP surfaces: an Injection API at v1 that does nothing but send mail, and a SocketLabs API at v2 for configuration, suppression, reporting and subaccounts. Both are plain JSON over HTTPS, both are wrapped by 8 first-party SDKs, and 5 of those have not shipped since 2023. On MCP the answer is unambiguous: there is no SocketLabs MCP server in 2026, official or community, so any agent workflow starts with a wrapper you write yourself.

At a glance

MCP integration in 2026

Model Context Protocol lets an agent call a vendor API without a hand-rolled tool schema per endpoint: query bounces, add suppressions, send a test. SocketLabs ships nothing of the kind.

Available MCP servers

Short by necessity: what exists, and what it covers.

SocketLabs API essentials

The most expensive misunderstanding here is treating “the SocketLabs API” as one thing. It is two, with different base URLs, auth styles and lifecycles: Injection sends mail and nothing else; v2 does everything else and never sends mail.

Pagination is offset-based and returns no link headers, so rows shift between pages when events land mid-export. Where a stable snapshot matters, bound every query with explicit dates and treat the window, not the page, as your unit of idempotency.

Authentication methods

SocketLabs issues three unrelated credentials with different scopes. None substitutes for another, and getting this wrong is the platform’s signature failure.

Injection API: serverId plus APIKey in the body

The classic Injection API takes a numeric serverId and a string APIKey, both inside the JSON body, not in a header. Every SDK constructor mirrors this: SocketLabsClient(serverId, apiKey). The credential travels in the payload, so it lands in request-body logs.

Bearer token for the v2 API and the CX gateway

The SocketLabs API at https://api.socketlabs.com/v2 uses a standard Authorization: Bearer header. The v2 migration consolidated the formerly separate Reporting and Suppression keys into this one. The newer inject-cx gateway also uses Bearer auth, a signal of where the platform is heading.

SMTP credentials

A third username and password pair drives the relay at smtp.socketlabs.com. The username is issued, not chosen, in the form server12345 – server plus your numeric Server ID. Provision it under Configuration › SMTP Credentials.

Event webhook verification

Event Webhooks are inbound, so there is no request to authenticate. SocketLabs puts a SecretKey and ServerId in the POST body; return 401 on mismatch, 200 otherwise. Validation traffic comes from 52.152.150.178, production from 142.0.176.0/20.

Rate limits

SocketLabs publishes firm structural ceilings and no throughput ceiling at all. The table separates the two: numbers you can design against, and numbers you cannot.

Two absences matter. No request-rate limit is documented for either API: no headers, no described 429 behaviour, so you cannot derive a back-off strategy from the docs and must retry exponentially on 5xx. And the new-account throttle is real but unquantified, the docs say only that it lifts automatically, that complaints and bounces prolong it, and that it “can be adjusted by opening a support ticket.” Migrating an established stream? Open that ticket before cutover.

The workaround for the 20-connection ceiling is pipelining, not parallelism: SocketLabs recommends command pipelining and 50 messages per connection. Beyond that, the Injection API takes a Messages array and skips the connection model.

Official SDKs

SocketLabs maintains 8 client libraries, all wrappers over the Injection API. None covers the v2 management and reporting surface, which you call with a plain HTTP client. The maintenance picture is uneven enough to shape language choice.

Notable community SDKs

There is none worth naming. Unlike Mailgun, whose API attracted independent Rust, Elixir and Laravel clients, SocketLabs never drew third parties in to fill the gaps left by its dormant libraries. The practical community layer is framework-level: the WordPress.org plugin and the first-party ASP.NET Core webhook extensions for validating event POSTs.

Endpoints reference

The table covers the send path and the v2 management surface. Where the migration guide confirms a resource but never quotes its path, the column says so. Full docs: SocketLabs API introduction and the v1 to v2 migration guide.

Code examples

Python: send a basic message

from socketlabs.injectionapi import SocketLabsClient
from socketlabs.injectionapi.message.basicmessage import BasicMessage
from socketlabs.injectionapi.message.emailaddress import EmailAddress

# serverId is an integer; the API key is NOT your SMTP password
client = SocketLabsClient(10000, "YOUR-API-KEY")

message = BasicMessage()
message.subject = "Test"
message.html_body = "<html>Message body</html>"
message.from_email_address = EmailAddress("from@example.com")
message.to_email_address.append(EmailAddress("recipient@example.com"))

print(client.send(message).result)

Node.js: send with credentials from the environment

const { SocketLabsClient } = require('@socketlabs/email');

const client = new SocketLabsClient(
  parseInt(process.env.SOCKETLABS_SERVER_ID),
  process.env.SOCKETLABS_INJECTION_API_KEY
);

const message = {
  to: 'recipient@example.com',
  from: 'sender@example.com',
  subject: 'Hello from Node.js',
  textBody: 'Sent using the SocketLabs Node.js library.',
  htmlBody: '<html>Sent using the SocketLabs Node.js library.</html>',
  messageType: 'basic'
};

client.send(message)
  .then(res => console.log(res))
  .catch(err => console.error(err));

curl: raw Injection API POST

curl -X POST https://inject.socketlabs.com/api/v1/email \
  -H "Content-Type: application/json" \
  -d '{
    "serverId": 10000,
    "APIKey": "YOUR-API-KEY",
    "Messages": [{
      "To": [{ "EmailAddress": "recipient@example.com" }],
      "From": { "EmailAddress": "sender@example.com" },
      "Subject": "Raw injection test",
      "TextBody": "Sent without an SDK."
    }]
  }'

# Success: {"ErrorCode":"Success","MessageResults":[],"TransactionReceipt":"..."}

curl: read the v2 suppression list

# Bearer token here - NOT the Injection key, NOT the SMTP password
curl -X GET \
  "https://api.socketlabs.com/v2/servers/12345/suppressions?pageSize=100" \
  -H "Authorization: Bearer YOUR-SOCKETLABS-API-KEY"

Common gotchas

Deprecations and changelog

• July 9, 2026 – Infobip completed its acquisition of SocketLabs; terms not disclosed. Stated rationale: folding SocketLabs analytics, vendor-agnostic observability and intelligent routing into Infobip’s Email Deliverability Agent. No statement on brand, pricing, roadmap or support.
• May 2026 – Latest C# / .NET SDK release, the only first-party library updated in 2026 besides Go (February 2026).
• October 2025 – Email Relay expanded to more providers plus a Hurricane MTA Connector, routing traffic through third-party ESPs or a generic SMTP endpoint while keeping SocketLabs analytics. Last entry on Product Updates.
• June 2025 – Email Relay launched, letting customers route traffic through SocketLabs without fully migrating their sending platform, with stream-level routing.
• March 2024 – Legacy v1 Reporting and Suppression APIs decommissioned. All configuration, suppression and reporting moves to https://api.socketlabs.com/v2 with one bearer key.

Sources: SocketLabs Product Updates and the v1 to v2 migration guide.

Frequently asked questions