turboSMTP API + MCP (2026): v2 ships, official MCP server does not

turboSMTP ships a documented HTTP API alongside its relay: v2, described by a public OpenAPI 3.1.0 specification, with one sending endpoint and a management surface covering analytics, suppressions, subaccounts and validation. Five official SDKs are announced and four are published. The MCP story needs care: turboSMTP has documented an official @turbosmtp/mcp-server, named its tools and environment variables, and has not shipped it. Everything installable today is a community wrapper or a brokered surface.

At a glance

MCP integration in 2026

Model Context Protocol gives an AI agent typed, permissioned access to a sending platform instead of a raw API key and a curl template. For a transactional relay the useful tools are narrow: send a message, read delivery metrics, check domain authentication. turboSMTP has specified exactly those in public, and has not shipped the server that implements them.

Available MCP servers

Several listings call themselves “the turboSMTP MCP server” and only one is code you can run. Glama, mcp.so and MCPMarket all index the same community repository. Distinct implementations only:

turboSMTP API essentials

The API is small by design: one endpoint sends mail, everything else reports on it or manages the account around it. The fact that trips people up is that sending and management live on different hosts.

The domain split is real, not a spec typo: the company markets on serversmtp.com, sending hosts live on turbo-smtp.com, management sits on pro.api.serversmtp.com. Configure two base URLs and move on. The EU host is confirmed by turboSMTP’s API reference and the Symfony Mailer bridge, but no public page explains how an account is placed in that region, confirm with support before hardcoding it into a deployment with residency obligations.

Authentication methods

Two credential shapes exist and they are not interchangeable. Getting the split wrong produces a 401 on the one call that matters.

Consumer Key and Consumer Secret headers

The production method. Two custom headers on every request, consumerKey and consumerSecret, generated in the dashboard under API Keys. Permanent until revoked, and the only credential accepted by POST /mail/send. It is also the pair used for SMTP AUTH against pro.turbo-smtp.com – one credential, two protocols, and the secret is shown exactly once, so capture it before closing the dialog.

Bearer API key from POST /authorize

The management method. POST /authorize exchanges account credentials for a token passed as an Authorization header, valid 2 hours by default or never expiring with no_expire: true; POST /deauthorize revokes it. This token drives analytics, suppressions, subaccounts and tools, and is rejected by the sending endpoint. The authorize endpoint is itself rate-limited, and the spec instructs callers to cache and reuse the token rather than minting one per request.

Rate limits

This is the thinnest part of turboSMTP’s public documentation. The platform meters by plan volume rather than published throughput ceilings, and several figures competitors state as hard numbers simply do not exist here.

Build your own back-pressure rather than discover theirs. Base64 inflates a payload by roughly 33 percent, so the 24 MB API ceiling is reached by about 18 MB of raw attachments, size uploads against that, not the 30 MB headline. The one documented throughput lever is POST /subaccounts/{Id}/updatesubaccountsmtplimit, which caps a single subaccount, making subaccounts the de facto rate-limiting primitive: one per workload, each capped. If you need a published figure to design a queue against, SMTP2GO and Elastic Email document theirs more explicitly.

Official SDKs

turboSMTP publishes SDKs under its own GitHub organisation: C# and PHP in November 2023, Python in 2024, and a Node/TypeScript package in 2026 that is the only one with webhook verification. Maintenance is uneven, and the Go entry is an announcement rather than a package.

Notable community SDKs

The most significant non-first-party client is barely a community project: the Symfony Mailer bridge is maintained inside the Symfony organisation, at symfony/turbo-smtp-mailer. It exposes both transports through DSN – turbosmtp+smtp://KEY:SECRET@default and turbosmtp+api://KEY:SECRET@default – with EU variants and webhook parsing built in, and its release cadence follows Symfony’s rather than turboSMTP’s. It is also the only source outside turboSMTP documenting the EU relay host pro.eu.turbo-smtp.com. Beyond it the ecosystem is thin: no widely adopted Ruby, Java or Rust clients.

Endpoints reference

Fifteen resource groups cover the documented v2 surface. The canonical source is the OpenAPI document at turbo-smtp.yaml – generate a client from it rather than hand-writing one. Only the first row lives on the sending host.

Code examples

Sending with curl

Authentication is two custom headers, not Authorization, and recipients go in a comma-separated string, not an array.

curl -X POST https://api.turbo-smtp.com/api/v2/mail/send \
  -H "Content-Type: application/json" \
  -H "consumerKey: $TURBOSMTP_KEY" \
  -H "consumerSecret: $TURBOSMTP_SECRET" \
  -d '{
    "from": "hello@your-company.com",
    "to": "jane@example.com,john@example.com",
    "subject": "New live training session",
    "content": "Plain text fallback body.",
    "html_content": "<p>HTML body</p>"
  }'

Python: HTTP API, then the relay

turboSMTP’s own published Python sample uses http.client.HTTPConnection – plaintext HTTP. Do not ship it verbatim; use HTTPSConnection.

import http.client, json

KEY = "<CONSUMER_KEY>"
SECRET = "<CONSUMER_SECRET>"

payload = {
    "from": "hello@your-company.com",
    "to": "jane@example.com,john@example.com",
    "subject": "New live training session",
    "content": "Plain text fallback body.",
    "html_content": "<p>HTML body</p>",
}
headers = {"Content-Type": "application/json",
           "consumerKey": KEY, "consumerSecret": SECRET}

# api.eu.turbo-smtp.com if your account is provisioned in the EU region
conn = http.client.HTTPSConnection("api.turbo-smtp.com")
conn.request("POST", "/api/v2/mail/send",
             body=json.dumps(payload), headers=headers)
r = conn.getresponse()
print(r.status, r.read().decode("utf-8"))
conn.close()

# The relay alternative: smtplib.SMTP_SSL("pro.turbo-smtp.com", 465),
# then smtp.login(KEY, SECRET) - the same pair, never your account password.

Node and TypeScript: official SDK

The @turbosmtp/mail package returns the message id you later pass to GET /analytics/{Id} on the management host, with the bearer token rather than this key pair.

// npm install @turbosmtp/mail
import { TurboSmtp } from "@turbosmtp/mail";

const mailer = new TurboSmtp({
  key: process.env.TURBOSMTP_KEY!,       // Consumer Key
  secret: process.env.TURBOSMTP_SECRET!, // Consumer Secret
});

const { mid } = await mailer.send({
  from: "Sender <noreply@example.com>",
  to: "you@example.com",
  subject: "Hello",
  html: "<p>It works!</p>",
});
console.log("message id:", mid);

// Without the SDK: POST the same JSON to /api/v2/mail/send
// with the two headers. That is all it does.

Common gotchas

Deprecations and changelog

• May 7, 2026 – A fire at the NorthC Almere data centre took down sending and degraded ancillary services for several days. turboSMTP reported no data lost and core sending restored within 48 hours by failover to Frankfurt. The most significant availability event in the platform’s published history.
• September 30, 2025 – Official turboSMTP app launched on Zapier with Send Email and Find Email Status actions. Further triggers were said to be planned; the app still ships 0, so Zapier can send through turboSMTP but cannot be started by a delivery event.
• August 5, 2025 – Subaccounts extended down to the Basic tier, with individual credentials and reporting. Previously higher-tier, and the reason subaccount rate isolation is now viable on the entry plan.
• April 15, 2025 – API Key authentication became mandatory for SMTP connections, replacing account passwords with Consumer Key/Secret pairs. The most consequential change on this platform: every configuration guide written before this date names the wrong credential fields.
• October 6, 2021 – HTTP API v2 released with larger attachment support and an optimised backend. v1 was discontinued April 1, 2022, with a further cutoff notice dated June 30, 2024 on the legacy reference.

Release notes are published on turboSMTP’s news feed at serversmtp.com/news. Nothing versioned is embedded in the API reference, so diffing the OpenAPI YAML is the only reliable way to catch a silent schema change.

Frequently asked questions