Mailerlite Authentication

generated: '2026-08-13'
method: searched
source: openapi/*.yml (securitySchemes)
docs: https://developers.mailerlite.com/getting-started
also:
  - https://developers.mailerlite.com/cli
  - https://developers.mailerlite.com/mcp
  - https://mcp.mailerlite.com/.well-known/oauth-authorization-server
notes: >-
  Upgraded from derived to searched on 2026-08-13. The OpenAPI-only view showed
  a single bearer scheme; the docs show a THREE-SURFACE auth model in which the
  REST API is API-key-only while the CLI and the hosted MCP server both use
  OAuth. That distinction matters to an agent: the callable-by-agent surface
  (MCP) is OAuth with open Dynamic Client Registration, so an agent can
  authorize itself, while the REST surface requires a human to mint a key in
  the dashboard first.

summary:
  types: [http, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  oauth2_scopes: 0
  surfaces: [rest, cli, mcp]
  human_bootstrap_required_for_rest: true

schemes:
  - name: BearerAuth
    type: http
    scheme: bearer
    surface: rest
    in: header
    header: Authorization
    format: "Bearer <api key>"
    description: >-
      API key generated in the MailerLite dashboard under
      Integrations > MailerLite API > "Generate new token".
    docs: https://developers.mailerlite.com/getting-started
    sources:
      - openapi/mailerlite-subscribers-api-openapi.yml
      - openapi/mailerlite-groups-api-openapi.yml
      - openapi/mailerlite-segments-api-openapi.yml
      - openapi/mailerlite-fields-api-openapi.yml
      - openapi/mailerlite-campaigns-api-openapi.yml
      - openapi/mailerlite-automations-api-openapi.yml
      - openapi/mailerlite-forms-api-openapi.yml
      - openapi/mailerlite-webhooks-api-openapi.yml
    key_properties:
      shown_once: true
      stored_plaintext_by_provider: false
      rotatable: true
      scoped: false
      expiring: false
      named: true
      bound_to_user: true
    lifecycle_warning: >-
      Keys are permanently bound to the user who created them. Removing that
      user from the account — or deleting their user account — silently kills
      every integration using that key. There is no service-account concept.
    failure: '401 {"message": "Unauthenticated."}'

  - name: OAuth2 (MCP)
    type: oauth2
    surface: mcp
    resource: https://mcp.mailerlite.com/mcp
    flows:
      - flow: authorizationCode
        authorizationUrl: https://mcp.mailerlite.com/authorize
        tokenUrl: https://mcp.mailerlite.com/token
        refreshUrl: https://mcp.mailerlite.com/token
        scopes: {}
    registration_endpoint: https://mcp.mailerlite.com/register
    revocation_endpoint: https://mcp.mailerlite.com/token
    code_challenge_methods: [plain, S256]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
    dynamic_client_registration: true
    bearer_methods_supported: [header]
    metadata:
      authorization_server: https://mcp.mailerlite.com/.well-known/oauth-authorization-server
      protected_resource: https://mcp.mailerlite.com/.well-known/oauth-protected-resource/mcp
    description: >-
      OAuth 2.1-shaped authorization for the hosted MCP server, discovered
      through RFC 8414 + RFC 9728 metadata. No scopes are advertised — an
      issued token carries whatever the authorizing MailerLite user can do.
    probe:
      url: https://mcp.mailerlite.com/mcp
      method: POST
      date: '2026-08-13'
      http_status: 401
      www_authenticate: >-
        Bearer realm="OAuth",
        resource_metadata="https://mcp.mailerlite.com/.well-known/oauth-protected-resource/mcp",
        error="invalid_token"
    sources:
      - https://mcp.mailerlite.com/.well-known/oauth-authorization-server
      - https://developers.mailerlite.com/mcp

  - name: OAuth2 (CLI)
    type: oauth2
    surface: cli
    flows:
      - flow: authorizationCode
    description: >-
      `mailerlite auth login` is browser-based OAuth and is the CLI's
      recommended default; tokens auto-refresh. `--method token` falls back to
      pasting a dashboard API key, and MAILERLITE_API_TOKEN covers CI.
    docs: https://developers.mailerlite.com/cli
    sources:
      - https://developers.mailerlite.com/cli

webhook_authentication:
  direction: inbound-to-customer
  mechanism: HMAC-SHA256
  header: Signature
  key: The webhook `secret` returned when the webhook is created
  signed_material: raw JSON request body
  timestamp_in_signature: false
  replay_protection: >-
    None published — no timestamp is signed and no tolerance window is
    documented. Receivers must add their own replay defence.
  docs: https://developers.mailerlite.com/api/webhooks

not_supported:
  - openIdConnect
  - mutualTLS
  - basic auth
  - hmac request signing on outbound REST calls
  - scoped / least-privilege API keys
  - key expiry

gaps:
  - >-
    No scope surface anywhere: neither the REST keys nor the MCP OAuth tokens
    can be narrowed. A token that can list subscribers can also schedule a
    campaign send.
  - >-
    No service-account identity — API keys inherit and die with a human user.

maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com