Customer.io
Connect Customer.io to manage people and segments, run campaigns and broadcasts, send transactional messages, and track delivery performance.
You paste one Customer.io service account token starting with sa_live_, then pick which Customer.io workspace to connect. An App API key is optional and only adds the classic App API tools.
- Setup time
- 4 min
- Auth
- API credentials
- API base URL
- https://us.fly.customer.io (EU accounts: https://eu.fly.customer.io); Track and transactional calls use track.customer.io or track-eu.customer.io
- Rate limits
- App API: 10 requests per second, with 429 and a Retry-After header above that; transactional messages aren't rate limited. API-triggered broadcasts: 1 request every 10 seconds. Track and Pipelines APIs: a guideline of 3,000 requests per 3 seconds that Customer.io doesn't enforce by rejecting calls.
Before you begin
- A Customer.io account in the US or EU data center. PopMCP detects which one.
- Access to Account Settings, API Credentials. A user service account only reaches the workspaces its creator can open; only admins can create a system service account, which covers every workspace.
- The Customer.io workspace you want connected. Each one maps to its own PopMCP workspace.
Get your credentials
Quickest path: copy a token from fly.customer.io/cli
Open https://fly.customer.io/cli, sign in to Customer.io and copy the token it shows. It starts with sa_live_. Then jump to the last step. Prefer to create and name the token yourself? Follow the next three steps instead.
Create a service account
Go to Account Settings then API Credentials and open the Service Accounts tab. Click Create Service Account, enter a name such as PopMCP, choose the type (a user account inherits your permissions; a system account takes a role and covers every workspace) and click Create.
API Credentials
Keys and service accounts for Customer.io's APIs and CLI.
| Name | Type | Tokens | Created |
|---|---|---|---|
| ci-deploysCreated by Dana Reyes | System | 1 | Apr 2, 2026 |
| dana-cliCreated by Dana Reyes | User | 2 | Sep 14, 2026 |
Only admins can create a system service account. A user account only reaches the workspaces its creator can open.
Create a token with No expiration
Expand the service account and click Create Token. Enter a Name, set Expiration to No expiration, and for a system account choose a Role. Leave Read-only unticked unless the AI should only read (it permanently limits a user token to GET requests). Click Create.
API Credentials
Keys and service accounts for Customer.io's APIs and CLI.
Expiration also offers 30, 60 or 90 days or 1 year. An expired token disconnects PopMCP until you paste a new one.
Copy the token
Copy the sa_live_ value straight away and keep it somewhere safe. Customer.io shows it only once; if it's lost, create another token on the same service account.
API Credentials
Keys and service accounts for Customer.io's APIs and CLI.
Builder sandbox accounts issue sa_sandbox_ tokens instead; PopMCP accepts those too.
Optional: create an App API key
Skip this unless you want the classic App API tools (the app_ tools). Transactional sends and the Track API already work through the token. On the App API Keys tab, click Create App API Key for the workspace you will connect and copy the key.
API Credentials
Keys and service accounts for Customer.io's APIs and CLI.
| Name | Workspace | Last used |
|---|---|---|
| Website backend...9f2c | Production | Today |
An App API key belongs to one workspace. PopMCP checks it matches the workspace you connect.
Paste the token into PopMCP
Paste the token into Service account token and, if you made one, the key into App API key (optional). PopMCP tries Customer.io's US data center and then the EU one, lists every workspace the token can open, and lets you assign each to a PopMCP workspace.
Connect in PopMCP
Open your workspace, choose Customer.io in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Service account tokensecret | Quickest: open fly.customer.io/cli, sign in, and copy the token it shows. Or in Customer.io: Settings → API Credentials → Service Accounts → Create Service Account → Create Token (choose No expiration). A user service account token gets your own permissions; a system one with an Admin role reaches every workspace. Stored encrypted, used server-side only.Encrypted with AES-256-GCM on save and never shown again. |
| App API key (optional)secret | Leave empty unless you want the classic App API tools (app_*): everything else, including transactional sends and the Track API, works without it. Settings → API Credentials → App API Keys → Create App API Key, for the workspace you're connecting.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Customer.io immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows Customer.io as Verified, labelled with your account and workspace name, such as Acme · Production. Ask for the five most recently updated people: customerio_list_customers returns real profiles from that workspace instead of a 401.
Troubleshooting
"Customer.io didn't accept that service account token in its US or EU data center"
Why: The token was copied incompletely, or it was revoked, deleted or has expired.
Fix: Create a new token on the Service Accounts tab with Expiration set to No expiration, and paste the whole sa_live_ value.
"That looks like an App API key" when you paste into the first field
Why: An App API key or Track API key was pasted instead of a service account token.
Fix: Put a service account token (starts with sa_live_) in Service account token. The App API key can go in App API key (optional).
"This service account token can't see any Customer.io workspace"
Why: A user service account only reaches the workspaces its creator can open, and that person has none, or the account has no workspace access yet.
Fix: Give the creator access to the workspace, or have an admin create a system service account with a role.
Tools start failing with "Customer.io no longer accepts this connection's service account token"
Why: The token reached its expiration date, or someone revoked it or deleted the service account.
Fix: Create a new token with No expiration and reconnect Customer.io in PopMCP.
An edit answers 428 capability_required, or 403 agent_editing_disabled
Why: Customer.io wants a person to approve some live changes (deleting an automation, merging profiles, editing a running automation), or the workspace blocks agent edits to live data. A read-only token also gets 403 on writes.
Fix: Make that change in Customer.io yourself, or use a token without Read-only. PopMCP can't grant Customer.io's approval for you.
Track tools say the workspace has no Track API key yet
Why: PopMCP reads the workspace's Track API Site ID and key through the token, and this workspace has never had one.
Fix: Create one under Account Settings, API Credentials, Track API Keys (or ask the AI to run customerio_create_api_credential), then retry.
"That App API key belongs to a different Customer.io workspace"
Why: The optional App API key was created for another workspace than the one you picked.
Fix: Create an App API key for the connected workspace, or leave the field empty.
Reference
Constant Contact
Connect Constant Contact to manage contacts, lists and tags, build and send email campaigns, run events and automations, and track opens and clicks.
Ghost
Connect Ghost to write and publish posts, send newsletters, and manage pages, tags, members, tiers, offers, comments, and site analytics.