Everything in Mektup is a REST endpoint at https://api.usemektup.com/v1 and the same operation as an MCP tool. Start here, then go to the full references.
export MEKTUP_API_KEY=mek_live_...
# add a domain and get its DNS records
curl -X POST https://api.usemektup.com/v1/domains \
-H "Authorization: Bearer $MEKTUP_API_KEY" -H "Content-Type: application/json" \
-d '{"domain": "example.com"}'# after adding the records: verify, create a mailbox, send
curl -X POST https://api.usemektup.com/v1/domains/example.com/verify -H "Authorization: Bearer $MEKTUP_API_KEY"
curl -X POST https://api.usemektup.com/v1/domains/example.com/mailboxes \
-H "Authorization: Bearer $MEKTUP_API_KEY" -H "Content-Type: application/json" -d '{"localPart": "hello"}'
curl -X POST https://api.usemektup.com/v1/emails \
-H "Authorization: Bearer $MEKTUP_API_KEY" -H "Content-Type: application/json" \
-d '{"from": "hello@example.com", "to": "you@gmail.com", "subject": "It works", "text": "Hello from Mektup."}'
Authentication
API keys (mek_live_…) from the dashboard, sent as Authorization: Bearer. For servers, scripts, the CLI and the local MCP server.
OAuth 2.1 for platforms that act for their users (Lovable, Cursor, Replit): discovery, dynamic client registration and a consent screen. See the MCP reference.
Good to know
Limits count recipients you send to, account-wide: 50,000 a month, 2,000 a day, 300 an hour, 60 per 5 minutes on Starter. Over a limit: 429.
Webhooks fire once per new inbound message with an 8-second timeout and an HMAC-SHA256 X-Mektup-Signature. Poll GET /v1/messages as a fallback.
Sending without a mailbox: any address on a verified domain can send; a mailbox is needed to receive.
Inbound HTML is untrusted: sanitise and isolate it before you render it.
IMAP and SMTP:mail.usemektup.com, ports 993, and 465 or 587.
CLI:npx mektup-cli or npm i -g mektup-cli, then mektup --help.