SparkPost API + MCP (2026): stable v1 REST, no first-party MCP

SparkPost’s REST API has been on v1 since 2014 and remains the single source of truth for the platform — every send, template, webhook and metric flows through the same JSON surface exposed at api.sparkpost.com (US) and api.eu.sparkpost.com (EU). Official SDKs cover 6 languages but most were last tagged in 2018–2021, so teams shipping new integrations increasingly call the REST API directly. For AI agents the story is thinner: as of August 2026 there is no first-party MCP server, only three third-party wrappers (Zapier, Vinkius, MCP Bundles) built on top of the public API.

At a glance

MCP integration in 2026

SparkPost (owned by Bird, formerly MessageBird since November 2021) has not shipped a first-party Model Context Protocol server. The public REST API is stable and well-scoped, so third-party MCP wrappers appeared quickly — but if your compliance team requires a vendor-audited MCP surface for LLM agents, SparkPost is not there yet in 2026. Compare with Postmark and Resend, whose newer developer-first APIs have attracted more community MCP work, and SendGrid, which is in the same “wrapper-only” position.

Available MCP servers

Three hosted MCP surfaces are available today. All three read a SparkPost API key you provision yourself (US or EU region), so credential rotation stays inside your SparkPost account.

SparkPost API essentials

The API is organised around 15 top-level resources: Transmissions (create/list/cancel sends), Templates, Sending Domains, Tracking Domains, Inbound Domains, Relay Webhooks, event Webhooks, Events Search, Metrics/Deliverability, Suppression List, Recipient Lists, Recipient Validation, Subaccounts and IP Pools / Sending IPs. Most write endpoints accept the same JSON shape you would post via SMTP, so the API and SMTP relay share a mental model — useful when migrating from providers like Amazon SES or Brevo where the two channels are more decoupled.

Authentication methods

API key in Authorization header

The primary method. Provision an API key in the SparkPost dashboard under Configuration › API Keys, scope it to the minimum permissions needed (Transmissions: Read/Write, plus any specific resources), then send it as the raw Authorization header value — no Bearer or Basic prefix. Example:

curl -H "Authorization: 1234567890abcdef1234567890abcdef12345678" 
     https://api.sparkpost.com/api/v1/account

This differs from SendGrid and Postmark, which use Authorization: Bearer <key> and X-Postmark-Server-Token respectively. Copying a SendGrid header into a SparkPost request is one of the most common early-stage 401s.

HTTP Basic auth

For toolchains that only speak Basic auth, SparkPost accepts the API key as the username with an empty password. The equivalent curl:

curl -u "1234567890abcdef1234567890abcdef12345678:" 
     https://api.sparkpost.com/api/v1/account

SMTP AUTH LOGIN (SMTP endpoint only)

For the SMTP relay, authentication is unusual: the username is the literal string SMTP_Injection (case-sensitive), and the password is a SparkPost API key that carries the Send via SMTP permission. For subaccounts, append :X-MSYS-SUBACCOUNT=<subaccount_id> to the username. See the SparkPost SMTP tab for the full config.

Rate limits

SparkPost’s rate-limit philosophy is closer to Amazon SES than to SendGrid: there is no single account-wide RPM published in the docs, and the platform enforces a mix of monthly volume caps (HTTP 420 Enhance Your Calm) and per-endpoint throttles (HTTP 429) that you discover empirically. The pragmatic workaround: keep a jittered exponential-backoff wrapper around Transmissions and Events calls, respect the Retry-After header when present, and shift heavy Events queries to a nightly cron rather than the request path. High-volume customers (3M+ per month) can negotiate guaranteed burst rates as part of the Enterprise contract.

Official SDKs

SparkPost publishes SDKs for 6 stacks. All target the v1 REST API and cover the common surface (Transmissions, Templates, Suppressions, Webhooks) — but as of 2026 most release cadences are slow, and newer resources like Events Search and Signals Analytics are often easier to consume by calling the REST API directly.

Notable community SDKs

Beyond the six official clients, the ecosystem is small but functional: nodemailer-sparkpost-transport for any Node app that already speaks Nodemailer, a maintained Django backend at django-sparkpost, a Symfony Mailer bridge in the mainline Symfony repo, Laravel’s built-in SparkPost mail driver (deprecated in Laravel 9 but still functional via community shims), and the official Postman collection covering the full v1 surface. For Rust / Elixir / Kotlin there is no maintained wrapper — call the REST API directly.

Endpoints reference

The full API surface is 15 top-level resources. Full reference lives at the SparkPost Developer Hub; the table below is the short list you will use in practice.

Code examples

Python — send a templated transactional email

from sparkpost import SparkPost

sp = SparkPost('YOUR_SPARKPOST_API_KEY')  # or set SPARKPOST_API_KEY env var
# For EU: SparkPost('YOUR_SPARKPOST_API_KEY', base_uri='https://api.eu.sparkpost.com')

response = sp.transmissions.send(
    recipients=[{'address': 'user@example.com'}],
    from_email='hello@yourverifieddomain.com',
    subject='Hello from SparkPost',
    html='<p>Hi <strong>{{name}}</strong>, this is a test.</p>',
    text='Hi {{name}}, this is a test.',
    substitution_data={'name': 'Friend'},
    track_opens=True,
    track_clicks=True,
)

print(response['id'], response['total_accepted_recipients'])

Node.js — same call with the official SDK

const SparkPost = require('sparkpost');
// For EU: new SparkPost('YOUR_SPARKPOST_API_KEY', { origin: 'https://api.eu.sparkpost.com' })
const client = new SparkPost('YOUR_SPARKPOST_API_KEY');

client.transmissions.send({
  content: {
    from: 'hello@yourverifieddomain.com',
    subject: 'Hello from SparkPost',
    html: '<p>Hi <strong>{{name}}</strong>, this is a test.</p>',
    text: 'Hi {{name}}, this is a test.',
  },
  substitution_data: { name: 'Friend' },
  recipients: [{ address: 'user@example.com' }],
  options: { open_tracking: true, click_tracking: true },
})
.then(data => console.log('Sent:', data.results.id))
.catch(err => console.error('SparkPost error:', err));

Raw curl — when you cannot pin an SDK

curl -X POST https://api.sparkpost.com/api/v1/transmissions 
  -H "Authorization: YOUR_SPARKPOST_API_KEY" 
  -H "Content-Type: application/json" 
  -d '{
    "options": { "open_tracking": true, "click_tracking": true },
    "content": {
      "from": "hello@yourverifieddomain.com",
      "subject": "Hello from SparkPost",
      "html": "<p>Hi <strong>{{name}}</strong>, this is a test.</p>",
      "text": "Hi {{name}}, this is a test."
    },
    "substitution_data": { "name": "Friend" },
    "recipients": [ { "address": "user@example.com" } ]
  }'

Common gotchas

Deprecations and changelog

• February 1, 2024 — Gmail and Yahoo bulk-sender requirements (DMARC, one-click List-Unsubscribe, <0.3% spam complaint rate) become enforceable. SparkPost ships Signals Analytics guidance for reaching the complaint threshold and updates the official WordPress plugin to add List-Unsubscribe headers by default.
• February 8, 2023 — MessageBird rebrands to Bird. The SparkPost email product keeps shipping under the SparkPost name and endpoints (sparkpost.com, sparkpostmail.com), gradually surfaced under bird.com.
• November 24, 2021 — SparkPost acquired by MessageBird, joining what would become the Bird platform. API and SMTP endpoints preserved unchanged.
• November 9, 2021 — python-sparkpost 1.3.10 released. Last tagged release of the official Python SDK; still compatible with the v1 REST API but new resources require calling the API directly.
• April 29, 2021 — Sending Domains API adds the scph<selector> DKIM CNAME rotation used by all new domains from that date forward (selector prefix scph0421).

Full release notes: SparkPost Developer Hub release notes.

Frequently asked questions