Mailgun
Connect Mailgun to send and schedule email, manage domains, templates, lists and suppressions, validate addresses, and track deliveries and opens.
You paste one Mailgun API key. An Account API key reaches every domain in both the US and EU regions; a Domain Sending Key also connects, send-only, when you type its domain in the optional default sending domain field.
- Setup time
- 3 min
- Auth
- API credentials
- API base URL
- https://api.mailgun.net (EU domains: https://api.eu.mailgun.net)
- Rate limits
- Mailgun publishes no single account-wide number: windows vary by API and are reported in the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers (reset in Unix milliseconds). Over the limit returns 429; Mailgun support can raise limits on request.
Before you begin
- A Mailgun account with at least one sending domain. A sandbox domain, or a Free plan with no card on file, only delivers to Authorized Recipients until you add a custom domain.
- The admin role on the Mailgun account, because only admins can create API keys
- If you have several sending domains, the one tools should use when a request doesn't name one, such as mg.example.com
- No region to look up: PopMCP finds US and EU domains itself
Get your credentials
Open API Security
Sign in at app.mailgun.com as an admin. Open the profile menu in the top right and choose API Security. Some Mailgun docs show the same page as Account Settings then API keys.
API Security
Account API keys work for every domain you own, in both regions.
| Description | Role | Created | Expires |
|---|---|---|---|
| Primary account key****-3f9a21c7 | Admin | Feb 2, 2025 | Never |
| Reporting dashboard****-8b0d44e2 | Analyst | Jun 18, 2026 | Never |
Mailgun lists keys by description and the end of their ID. The full secret is shown only when a key is created.
Add a key with the Admin or Developer role
Click Add new key, enter a description such as PopMCP, choose a role if your plan offers roles, and click Create Key. Admin reaches every tool. Developer covers everything except API keys, SMTP credentials and users. Analyst is read-only. A key's role can't be changed later, only replaced with a new key.
API Security
Account API keys work for every domain you own, in both regions.
Developer is enough for sending, domains, events, suppressions, templates and lists. Pick Admin if the AI should also manage keys, SMTP credentials or users.
Copy the key while it is shown
Copy the new key straight away. It looks like 32 hex characters followed by two groups of 8, separated by hyphens. Mailgun shows a role-based key only once, so store it before closing the dialog.
API Security
Account API keys work for every domain you own, in both regions.
Do not copy the HTTP webhook signing key or the Public validation key (pubkey-...) by mistake. Neither can run the connector.
Check your sending domains
Open Domains and note the domain tools should use by default, exactly as it is listed, for example mg.example.com. Using a Domain Sending Key instead of an account key? Select the domain, open its sending keys tab and click Add Sending Key; that key can only send mail for its own domain.
Domains
Each domain lives in one region. API keys work in both.
| Domain | Region | State | Type |
|---|---|---|---|
| mg.example.comCreated Mar 3, 2026 | US | Active | Custom |
| eu.mg.example.comCreated Jul 9, 2026 | EU | Active | Custom |
| sandbox4c2e....mailgun.orgCreated Feb 2, 2025 | US | Sandbox | Sandbox |
A sandbox domain only delivers to Authorized Recipients. Send real mail from a verified custom domain.
Paste the key into PopMCP
Paste the key into API key. Fill Default sending domain (optional) only if you have several domains or pasted a Domain Sending Key. You never pick a region: PopMCP lists your domains on both the US and EU hosts and sends each call to the domain's own region.
Connect in PopMCP
Open your workspace, choose Mailgun in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| API keysecret | In Mailgun open API Security (profile menu, or app.mailgun.com/settings/api_security) and click Add new key. Admin unlocks every tool; Developer covers everything except API keys, SMTP credentials and users; Analyst is read-only. Stored encrypted and sent only to Mailgun.Encrypted with AES-256-GCM on save and never shown again. |
| Default sending domain (optional)text | Used when a tool isn't told which domain to act on. Leave it empty if you have one sending domain. Fill it in if you paste a Domain Sending Key, which can only send mail for its own domain. |
PopMCP verifies the credential against Mailgun immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows Mailgun as Verified with a label such as Mailgun · mg.example.com (US), Mailgun · 3 domains (US + EU), or (send only) for a Domain Sending Key. Ask for yesterday's failed deliveries: mailgun_list_events returns real events instead of an authentication error.
Troubleshooting
"Mailgun rejected this API key" when connecting
Why: The key was cut short, revoked or expired, it is a Domain Sending Key with no domain typed, or your Mailgun account restricts API access to an IP allowlist.
Fix: Create a fresh Account API key under API Security with the Admin or Developer role and paste it whole. For a Domain Sending Key, also fill Default sending domain (optional).
"That's the Public validation key, which can only validate addresses"
Why: The pubkey-... value was copied instead of an account key.
Fix: Copy an Account API key from API Security (Add new key) instead.
"The domain ... isn't in this Mailgun account"
Why: The default sending domain has a typo, or it is the From domain (example.com) rather than the Mailgun sending domain (mg.example.com).
Fix: Copy the domain exactly as Mailgun lists it under Domains, or leave the field empty.
"This Mailgun tool needs a domain and your account has several"
Why: No default sending domain is set and the request didn't name one.
Fix: Tell the AI which domain to use, or reconnect with Default sending domain (optional) filled in.
Sends from a sandbox domain fail with a message that the domain is not allowed to send
Why: Sandbox domains, and Free plans with no card on file, only deliver to Authorized Recipients.
Fix: Add the recipient as an Authorized Recipient in Mailgun, or add and verify a custom sending domain.
403 "Valid credentials but access denied" on writes
Why: The key's role is too narrow for that action, for example an Analyst key trying to send or a Developer key managing API keys.
Fix: Roles can't be edited. Create a new key with the Developer or Admin role and reconnect.
"Domain not found" for a domain you know exists
Why: The domain sits in the other region or was created after you connected, and Mailgun's regional hosts don't see each other's domains.
Fix: Try again once: PopMCP looks up a new domain's region the first time a tool uses it. If it persists, reconnect so PopMCP re-reads the domain list from both regions.