- Marketing API or Transactional API?
- How the Marketing API works
- A typical first job: keeping contacts in sync
- Getting started with the client libraries
- The conditions on API keys
- The workaround: keep keys server-side, use OAuth 2 for others
- APIs from other email platforms
- My verdict on the Mailchimp API
- Frequently asked questions
Yes, Mailchimp has an API, in fact two. The Marketing API handles campaigns, audiences and contacts, and the separate Transactional API (formerly Mandrill) sends event-driven email and SMS. The Marketing API is REST at api.mailchimp.com/3.0/, authenticated with an API key or OAuth 2, and API keys mustn't be used in browsers or mobile apps.
Yes, and the first thing to work out is which of the two you need. That depends on whether you're sending marketing to a list or sending one-off messages triggered by something a customer did.
Marketing API or Transactional API?
| API | What it's for | How it sends |
|---|---|---|
| Marketing API | Marketing campaigns, audiences and contacts | REST with JSON responses |
| Mailchimp Transactional (formerly Mandrill) | Event-driven transactional email and SMS | Via the API or SMTP |
If you're syncing contacts from your CRM or shop into an audience, or creating campaigns from code, it's the Marketing API. If you're sending order confirmations, password resets or similar messages triggered by an event, it's Transactional.
How the Marketing API works
The Marketing API follows REST conventions, returns JSON and is described with an OpenAPI specification. Its root URL is api.mailchimp.com/3.0/. It accepts GET, POST, PATCH, PUT and DELETE. PUT is handy for syncing contact data, and PATCH only needs the data you want to change.
- Contacts are addressed by the MD5 hash of the lowercase email address, so you don't need to store Mailchimp's internal contact IDs.
- Pagination uses offset and count query parameters, for example campaigns?count=10 with offset=10 for the second page.
- If a firewall blocks PATCH or DELETE, send POST with the X-HTTP-Method-Override header. The override only works with POST.
A typical first job: keeping contacts in sync
Most small businesses come to the Marketing API for one reason: keeping an audience in step with a shop, CRM or booking system. The design makes that simpler than it sounds. Because contacts are addressed by the MD5 hash of their lowercase email address, your system can work out where a contact lives in Mailchimp from the email alone, without storing Mailchimp's own IDs. PUT then creates the contact if it's new or updates it if it exists, which is why Mailchimp calls it useful for syncing. Use PATCH when you only want to change one or two fields, such as a tag or a merge field, and leave the rest alone.
Getting started with the client libraries
Official client libraries exist, for example npm install @mailchimp/mailchimp-marketing for Node and pip install mailchimp-marketing for Python. The quickstart checks your credentials with the Ping endpoint, which is the sensible first call: if Ping works, your key and setup are right.
The conditions on API keys
This is where Mailchimp is strict, and for good reason. Mailchimp Developer Docs say an API key authenticates against the account it was created in and carries full access. There's no read-only key and no per-endpoint restriction, and keys don't expire until you delete them.
On top of that, Mailchimp doesn't support client-side CORS calls to the Marketing API, and rules out browsers and mobile apps for API keys. A key in front-end JavaScript would be visible to anyone who looks, and it would open the whole account.
The workaround: keep keys server-side, use OAuth 2 for others
Keep every API key on a server you control, and never ship one inside a website or app. If you're building something that acts on other people's Mailchimp accounts, Mailchimp points to OAuth 2 instead of asking users for their keys. Because keys don't expire, delete any you're no longer using, and create a fresh one if a key's ever been exposed.
If the difference between pulling data with an API and being told about changes is new to you, my explainer on APIs versus webhooks is a quick read.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
APIs from other email platforms
Brevo offers a unified REST API for sending messages across email, SMS and WhatsApp and managing contacts, custom events, eCommerce data and custom objects. Klaviyo publishes a versioned API reference with endpoints for API keys and applications. For the bigger comparison, see my Klaviyo versus Mailchimp guide.
My verdict on the Mailchimp API
It's a mature, well-documented REST API, and the client libraries make it quick to start. Choose the Marketing API for lists and campaigns and Transactional for event-driven messages. Treat every key as the keys to the whole account: server-side only, deleted when unused, and OAuth 2 for anything touching other people's accounts. Check plan details with Mailchimp before you build on a specific feature.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Is the Mailchimp API available to everyone?
The developer docs describe it generally and don't state plan restrictions on the page, so check with Mailchimp before relying on a specific plan.
Can I call the API from JavaScript in a browser?
No. Mailchimp doesn't support client-side CORS calls.
What is the API root URL?
api.mailchimp.com/3.0/, over HTTPS.
Is there a separate API for transactional email?
Yes, Mailchimp Transactional (formerly Mandrill).
Can I restrict an API key to read-only?
No. Keys carry full account access.
