---
title: "Developer API and MCP - Workflow Transactional Email"
description: "Manage your HTTP requests, email templates and senders from your own code over a REST API, or from an AI assistant over MCP. Secrets are never readable."
canonical: "https://docs.workflow-transactional-email.app/developer-api-and-mcp"
---

# Developer API and MCP

You can manage your actions - HTTP requests, email layouts, senders and secrets - from your own code or from an AI assistant. Workflow Transactional Email exposes a **REST API** and an **MCP server**, both managed on the **Developer** page inside the app.

Everything uses one credential, and both surfaces enforce the same rules: your secrets are never readable, and history is PII-masked on the way out.

- [Authentication and API keys](https://docs.workflow-transactional-email.app/developer-authentication.md) - Create a key, pick its access level, and understand why execute is separate.

- [REST API reference](https://docs.workflow-transactional-email.app/developer-rest-api.md) - Every endpoint, the level it needs, query parameters, status codes and rate limits.

- [Connect an AI assistant (MCP)](https://docs.workflow-transactional-email.app/developer-mcp.md) - Point Claude, Cursor, VS Code or Gemini CLI at your account, with tools gated by key level.

## The short version

**Base URL**

```text
https://shopify.workflow-transactional-email.app
```

**Authenticate** with a bearer key created on the Developer page. Keys start with `fak_` and are shown once, at creation.

**Three access levels**, ordered and cumulative:

| Level | Adds |
| --- | --- |
| Read | List and read actions, layouts, senders, secret names, history, stats |
| Read & write | Create, update and delete HTTP requests |
| Read, write & execute | Run a configured HTTP request for real |

Issue read keys by default.

> [!WARNING]
> **Your secrets are never readable**
> Secret values, SMTP passwords and OAuth tokens cannot be read back at any access level, through either surface. There is no endpoint and no tool that returns them - you get names and `hasValue` flags instead.
>
> So an assistant can correctly write `{{ secrets.stripeApiKey }}` into a request without the key ever entering its context, and a leaked read key exposes your configuration rather than your credentials.

## A first request

Confirm a key works and see what it can do:

```bash
curl https://shopify.workflow-transactional-email.app/api/v1/me \
  -H "Authorization: Bearer fak_your_key_here"
```

## Related reading

- [Secrets](https://docs.workflow-transactional-email.app/secrets.md) - how secrets work in the app itself.
- [Make an HTTP request from Shopify Flow](https://docs.workflow-transactional-email.app/make-an-http-request.md) - the HTTP action these endpoints configure.
- [History and troubleshooting](https://docs.workflow-transactional-email.app/history-and-troubleshooting.md) - what execution history records.