Agentic Fabriq
Mailcoach
MARKETING · EMAIL
Email lists, subscribers, campaigns, and templates on their own key.
Connecting Mailcoach in practice
Mailcoach’s limits are per endpoint class rather than per account: 5 requests a second on authenticated endpoints against 50 on transactional email endpoints, so syncing an audience is ten times slower than sending to it. The base URL is the customer’s own subdomain, https://[your-domain].mailcoach.app/api, which means there is no fixed host to configure and the same integration points somewhere different for every account.
Scopes that draw scrutiny
Bearer tokenThe only credential, sent as `Authorization: Bearer $MAILCOACH_TOKEN`. Mailcoach documents no scopes, so one token covers audiences, campaigns, automations and transactional sending alike.
Rate limits
- Authenticated endpoints: 5 requests per second.
- Transactional email endpoints: 50 requests per second.
- Unauthenticated endpoints: 60 requests per minute per IP.
- Over the limit returns 429 Too Many Requests with a Retry-After header in seconds; normal responses carry X-RateLimit-Limit and X-RateLimit-Remaining.
Worth knowing
- At 5 requests a second on the authenticated endpoints, a large subscriber reconciliation is an hours-long job, while the transactional path next to it runs ten times faster — so throughput depends on which endpoint you picked, not which plan you are on.
- Mailcoach ships both as a hosted service and as self-hosted Laravel software with its own separately versioned documentation, so the available API surface depends on which one the customer runs and which major version they are on.
- The per-install subdomain means credentials and base URL always travel together; a token is meaningless without knowing which Mailcoach it belongs to.
- The unauthenticated 60-per-minute-per-IP bucket is shared by everything behind one egress address, so several agents on the same host compete for it before they have even authenticated.
Checked against Authentication and rate limiting (2026-09-29), About the API (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Mailcoach behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.