API Key MCP Email Authentication with marginal
When an AI agent runs email experiments on your behalf, every request needs to be authenticated. marginal uses a simple Bearer API key model so your agent can connect to the email MCP server, launch subject line A/B tests, and read results without ever exposing your account.
How API key authentication works
marginal authenticates every MCP call with a Bearer API key. Your key looks like marg_live_... and is sent in the Authorization header when your agent connects to the endpoint at https://marginal.sh/mcp. There's no OAuth dance and no self-hosted server to stand up — marginal is fully hosted, so authentication is the only thing you configure.
- Endpoint: https://marginal.sh/mcp
- Auth scheme: Bearer token (Authorization: Bearer marg_live_...)
- Registry identifier: sh.marginal/mcp
- One key authorizes all four MCP tools: generate_variants, launch_test, get_results, recommend_next
Why API keys fit AI agent email marketing
AI agent email marketing means a model can autonomously generate variants, launch a test, and recommend the next move. That autonomy is only safe when the credential is scoped, revocable, and never embedded in agent prompts. A static API key passed through your MCP client config keeps the secret out of the conversation while still letting the agent act.
Because the key lives in your client's configuration rather than in agent-visible context, you control exactly which workspace an agent can touch. Rotate the key and any old agent session loses access immediately.
- Keys are passed by the MCP client, not the language model
- Revoke or rotate without changing your agent logic
- The free tier includes 100 experiments per month to test the flow
Storing your key securely
Treat your marg_live_ key like any production secret. Most MCP clients — Cursor, Claude Desktop, Claude Code, Windsurf, Cline, Continue, Zed, and OpenAI Codex — let you reference an environment variable instead of pasting the raw token into a checked-in config file.
- Prefer an env var (e.g. MARGINAL_API_KEY) over inline secrets
- Never commit a key to source control or share it in chat logs
- Use separate keys for development and production where possible
- Rotate a key if it appears in a build artifact or screenshot
From authentication to your first A/B test
Once the key authenticates, the same credential unlocks the full subject line A/B test workflow. Your agent calls generate_variants to draft subject lines, launch_test to send the managed experiment, and get_results to read open/click tracking and within-test lift. recommend_next then suggests a winning direction.
See the marginal docs at https://marginal.sh/docs/ for the exact request shape and per-tool parameters once your API key MCP email authentication is in place.
- generate_variants — draft candidate subject lines
- launch_test — start a managed send with tracking
- get_results — pull opens, clicks, and lift metrics
- recommend_next — get the next experiment suggestion
Get started with marginal
marginal is a hosted email marketing MCP server at marginal.sh. Sign up free, create an API key, and connect https://marginal.sh/mcp from Cursor, Codex, or Claude Desktop.
- 100 experiments/month on the free tier
- Four MCP tools: generate_variants, launch_test, get_results, recommend_next
- Listed in the MCP Registry as sh.marginal/mcp