Generic / custom client

Any streamable-HTTP MCP client that speaks MCP OAuth connects with just the URL. Anything else uses a Bearer API key.

What are the connection details?

Server URLhttps://mcp.unitpost.com/mcp
TransportStreamable HTTP
Auth (recommended)OAuth 2.1 — add the URL, approve in the browser(scopes match API capabilities; tokens refresh automatically)
Auth (legacy)Authorization: Bearer pk_live_YOUR_KEY(workspace API key from Settings → API keys; for clients that can only paste a key)
Toolsone per API operation (email_send, email_campaigns_send, …)

How do I connect Generic / custom client?

  1. Connect with OAuth (recommended)

    Point the client at the server URL below. A spec-compliant client discovers OAuth itself: it reads the WWW-Authenticate: Bearer resource_metadata="…" challenge on the first 401, fetches /.well-known/oauth-protected-resource, runs the PKCE code flow against the advertised authorization server, and retries with the token. No key to copy. Your client opens Unitpost in the browser — pick a workspace, approve the scopes, and you're connected. Tokens refresh automatically.

    Server URLhttps://mcp.unitpost.com/mcp
    TransportStreamable HTTP
    Auth (recommended)OAuth 2.1 — add the URL, approve in the browser
    Auth (legacy)Authorization: Bearer pk_live_YOUR_KEY
    Toolsone per API operation (email_send, email_campaigns_send, …)
  2. Discover tools

    The server advertises one tool per API operation (email_send, email_campaigns_send, email_domains_verify, …). A write's body maps to the API request body. Every tool declares securitySchemes: [{ type: "oauth2", scopes: […] }] so linking-aware clients (ChatGPT) show the Connect UI.

  3. Verify

    Call a read tool (e.g. list domains). An unauthenticated call answers 401 with a WWW-Authenticate: Bearer resource_metadata="…" challenge (start OAuth there). With a key, a 401 Invalid API key usually means a missing Bearer prefix or a mistyped key — recreate the key and retry.

    Don't see it? Fully quit and reopen the client — closing the window is often not enough — then check again.

No browser on this machine? For headless setups, CI, SSH, or clients that can only paste a key, use the API-key setup instead.

Every MCP call uses the same pipeline as the REST API (scopes, rate limits, suppression, tracking, webhooks). Full tool list: /api/v1/openapi.json.