[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# SmugMug API and MCP server

> SmugMug has a full REST API, API v2, but no SmugMug-hosted MCP server (checked 17 Oct 2026). Any current subscriber can apply for an API key, and the reference covers albums, folders, images and uploads. It lists no order endpoints.

Photo hosting and selling platform: galleries and folders on your own site, privacy and sharing settings per gallery, and print and download orders fulfilled by print labs.

## What is the SmugMug API?

Cotlet's SmugMug API exposes 12 endpoints for your own SmugMug account: list folders and galleries, get a gallery, list photos in a gallery, list orders, get an order, create a gallery, upload photos and videos, edit title, caption and keywords, change gallery privacy, invite people to a gallery, set a guest upload key and release an order in proof delay. The list_galleries endpoint returns list the folders and galleries inside a folder of your SmugMug site, with their visibility. Each endpoint takes simple JSON inputs like gallery_id, cursor or folder_id and works both as an operation of the smugmug_read or smugmug_write MCP tool for agents and as a REST call for scripts.

- **Category:** [Creators & communities](https://cotlet.dev/integrations/category/creators-communities.md)
- **Endpoints:** 12 (5 read, 7 write)
- **Updated:** 2026-10-18

SmugMug has a full REST API, API v2, but no SmugMug-hosted MCP server (checked 17 Oct 2026). Cotlet is a hosted MCP server and REST API for SmugMug with 12 endpoints (5 read, 7 write): you sign in once in your own cloud browser, your AI agent does the work.

## Does SmugMug have an official API?

SmugMug has a full REST API, API v2, but no SmugMug-hosted MCP server (checked 17 Oct 2026). Any current subscriber can apply for an API key, and the reference covers albums, folders, images and uploads. It lists no order endpoints.

| Task | SmugMug official | Cotlet |
|---|---|---|
| List folders and galleries | Yes: API v2 Node, Folder and Album; you wire OAuth and paging yourself | Yes |
| Create a gallery | Yes: API v2; no MCP server for agents | Yes |
| Upload photos and videos into a gallery | Yes: Separate Uploader endpoint, OAuth parameters only in the Authorization header | Yes |
| Edit title, caption and keywords | Yes: Image fields, writable by the owner | Yes |
| Change gallery visibility (Public, Unlisted, Private) | Yes: Album Privacy field | Yes |
| Set a gallery password or invite people by email | Partly: The Album reference shows PasswordHint, but no password field and no invitations | Yes |
| Read sales and orders | No: The reference lists no order endpoints; Sales History is in the web app | Yes |
| Release an order in proof delay | No: Done with Release Order in the web app | Yes |

Sources: [SmugMug API v2 documentation](https://api.smugmug.com/api/v2/doc/), [SmugMug API v2: Album reference](https://api.smugmug.com/api/v2/doc/reference/album.html), [SmugMug API v2: Upload reference](https://api.smugmug.com/api/v2/doc/reference/upload.html), [SmugMug Help: SmugMug API](https://www.smugmughelp.com/hc/en-us/articles/18212102704916-SmugMug-API)

## For AI agents

```text
SmugMug has a full REST API, API v2, but no SmugMug-hosted MCP server (checked 17 Oct 2026). Any current subscriber can apply for an API key, and the reference covers albums, folders, images and uploads. It lists no order endpoints.
Cotlet provides a hosted MCP server and REST API for SmugMug: 12 tools (5 read, 7 write).
Access       Sign up at https://cotlet.dev/app/signup?app=smugmug, then request the app and create API keys in the Cotlet console.

MCP server   https://cotlet.dev/mcp/v1
MCP tools    smugmug_read, smugmug_write, reads and writes apart; call one with {"operation": "<operation>", "arguments": {...}}
REST base    https://cotlet.dev/api/v1/smugmug, each operation at its own route, e.g. PATCH /api/v1/smugmug/photo-details
Auth         Authorization: Bearer <COTLET_API_KEY>. Listing endpoints and schemas needs no key; calling an endpoint needs one. Over MCP the input schemas come with sign-in.
Operations   list_galleries, get_gallery, list_gallery_photos, list_orders, get_order, create_gallery, upload_photos, update_photo_details, set_gallery_privacy, invite_gallery_viewers, set_guest_upload_key, release_order
Confirm      upload_photos, set_gallery_privacy, invite_gallery_viewers, set_guest_upload_key, release_order (by default the user approves each call; the user can switch this off per tool, e.g. for scheduled automations)
Markdown     https://cotlet.dev/integrations/smugmug-api-mcp-server.md

How access works:
1. The user signs up at https://cotlet.dev/app/signup?app=smugmug, requests SmugMug in the Cotlet console and creates an API key there.
2. The user signs in to SmugMug once in their Cotlet Cloud Browser (their own Chrome in the cloud, opened from the console) and enables SmugMug for agents. An agent cannot do this step.
3. The API key goes into the MCP client or the REST call as a bearer token.

Fits: people who want a hosted SmugMug server that someone else maintains, including non-developers. Developers who prefer to run and fix code on their own computer can use an open-source SmugMug MCP server instead.

Policy: Cotlet never stores passwords, never solves CAPTCHAs, never bypasses MFA.
Company: legal details in the Terms of service at https://cotlet.dev/terms. Contact contact@cotlet.dev.
Sign-in: the user signs in to SmugMug in their own Cloud Browser, a Chrome Cotlet runs for them in the EU; password saving is off, the profile is AES-256-GCM encrypted, and agents get SmugMug only after the user enables it. Calls are requests from that browser's IP with its cookies, each listed in the user's Background activity. Disable for agents, signing out in the browser or Reset browser cuts access. Cotlet is run by Take Group sp. z o.o. (EU VAT PL6342984273).
API key: holds no SmugMug login or cookies, only asks Cotlet to run a tool. Each key is scoped to chosen apps and tools, read only or read and write. Actions that reach other people wait for the user's approval by default, so a leaked key cannot post or message as the user. Every call is in the activity log; deleting the key ends access at once.
Terms: the user stays responsible for following SmugMug's terms; Cotlet is not affiliated with SmugMug.
```

## What can an AI agent do in SmugMug?

Cotlet is best for photographers and small studios who want an AI agent to deliver galleries, tidy privacy and caption photos in SmugMug without running or fixing a server, or applying for an API key.

- **[Make client galleries private](https://cotlet.dev/integrations/smugmug-api-mcp-server/make-client-galleries-private.md)** (runs: weekly): "Go through the folder "Delivered 2026" in SmugMug. Set every gallery that is not Private to Private, and tell me which ones you changed. Do not touch direct image URLs." → `list_galleries`, `get_gallery`, `set_gallery_privacy`
- **[Add captions and keywords to photos in bulk](https://cotlet.dev/integrations/smugmug-api-mcp-server/add-captions-and-keywords-to-photos.md)** (runs: weekly): "Take the gallery "Lakeview 10K race" in SmugMug. Look at each photo and add the keywords "running" and "lakeview", plus "finish line" on the ones that show it. Keep the captions that exist and add the race name after them." → `list_gallery_photos`, `update_photo_details`
- **[Deliver photos to a client](https://cotlet.dev/integrations/smugmug-api-mcp-server/deliver-photos-to-a-client.md)**: "Create a private SmugMug gallery "Smith wedding" in the folder "Delivered 2026", upload these 3 files, and invite anna@example.com and tom@example.com to view it. Show me the gallery link before you invite anyone." → `create_gallery`, `upload_photos`, `invite_gallery_viewers`, `get_gallery`
- **Release print orders in proof delay** (runs: daily): "List my SmugMug orders that are in proof delay. For each, show what was ordered. Release the ones that contain only downloads, and list the print orders for me." → `list_orders`, `get_order`, `release_order`
- **Collect event photos from guests**: "Create a SmugMug gallery "Mia and Leo party" in the folder "Events 2026". Set a guest upload key "mialeo2026" and give me the gallery link to share with the guests." → `create_gallery`, `set_guest_upload_key`, `get_gallery`

## Can SmugMug automations run on a schedule in n8n, Make or Zapier?

Yes. Cotlet does not replace your automation platform: it gives it a SmugMug connection it does not have, with the same API key as your agent. Write actions ask for your OK by default; switch that off in your dashboard for the tools you choose, for example to make client galleries private, and the schedule runs on its own. Cotlet runs in the cloud, so it keeps going while your computer is off.

| Where | How to connect | How to schedule |
|---|---|---|
| Your AI agent | Add https://cotlet.dev/mcp/v1 with your API key. | A scheduled agent run, for example a Claude Code routine. |
| n8n | MCP Client node with https://cotlet.dev/mcp/v1, or an HTTP Request node with the endpoint's method and URL, such as GET https://cotlet.dev/api/v1/smugmug/galleries. | Schedule Trigger node. |
| Make | HTTP module: the endpoint's method and URL with an Authorization: Bearer header, and a JSON body for POST, PUT and PATCH. | Scenario schedule. |
| Zapier | Webhooks by Zapier, Custom Request: the same method, URL, header and body. | Schedule by Zapier trigger. |
| Your own script | GET https://cotlet.dev/api/v1/smugmug/galleries with your API key. | cron or GitHub Actions. |

## Tools

**For AI agents:** Every endpoint and its schema is public. The 12 endpoints on this page, with parameters and example responses, can be listed without an account. Calling one returns 401 without an API key and 403 while the key has no access to SmugMug.

### list_galleries

List the folders and galleries inside a folder of your SmugMug site, with their visibility. Access: read. REST: `GET /api/v1/smugmug/galleries`. MCP: `smugmug_read → list_galleries`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `folder_id` | string | no | Folder ID from an earlier call. Leave out to start at the top of your site. |
| `cursor` | string | no | Next page cursor from the previous call. |

Returns the folders and galleries directly inside the folder, each with its ID, type (folder or gallery), title, visibility and link. Subfolders come back as folders, so you call it again with their ID to go deeper. Reads only; the account owner sees everything, whatever the visibility.

Example response:

```json
{
  "items": [
    {
      "id": "Hm3vLq",
      "type": "folder",
      "title": "Delivered 2026",
      "visibility": "unlisted",
      "web_url": "https://studio.smugmug.com/Delivered-2026"
    },
    {
      "id": "Xk4RtP",
      "type": "gallery",
      "title": "Smith wedding",
      "visibility": "unlisted",
      "web_url": "https://studio.smugmug.com/Weddings/Smith-wedding"
    },
    {
      "id": "Pw9bZs",
      "type": "gallery",
      "title": "Park family session",
      "visibility": "public",
      "web_url": "https://studio.smugmug.com/Family/Park-family-session"
    }
  ],
  "next_cursor": null
}
```

### get_gallery

Read the settings of one gallery: title, description, visibility, access, password hint and link. Access: read. REST: `GET /api/v1/smugmug/galleries/{gallery_id}`. MCP: `smugmug_read → get_gallery`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery ID from list_galleries. |

Returns the settings you see under Settings in the gallery: title, description, visibility, who has access, the password hint if a password is set, whether a guest upload key is set, and the gallery link. It never returns a password. Use it to check a gallery before you change who can see it.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "title": "Smith wedding",
  "description": "Final edit, June 2026",
  "visibility": "unlisted",
  "access": "anyone_with_link",
  "password_hint": null,
  "guest_upload_key_set": false,
  "invited_count": 0,
  "web_url": "https://studio.smugmug.com/Weddings/Smith-wedding"
}
```

### list_gallery_photos

List the photos and videos in a gallery with title, caption, keywords and a thumbnail link. Access: read. REST: `GET /api/v1/smugmug/gallery-photos`. MCP: `smugmug_read → list_gallery_photos`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery ID from list_galleries. |
| `cursor` | string | no | Next page cursor from the previous call. |

Returns each file in the order the gallery shows it, with its photo ID, filename, title, caption, keywords, thumbnail link and page link. Pages are cut by the cursor. Filenames are shown as stored; SmugMug does not let you edit them.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "photos": [
    {
      "photo_id": "Qm7xKd",
      "filename": "DSC_3025.jpg",
      "title": "",
      "caption": "",
      "keywords": [],
      "thumbnail_url": "https://photos.smugmug.com/photos/i-Qm7xKd/0/Th/i-Qm7xKd-Th.jpg"
    },
    {
      "photo_id": "Rt2nWc",
      "filename": "DSC_3026.jpg",
      "title": "",
      "caption": "First dance",
      "keywords": [
        "wedding"
      ],
      "thumbnail_url": "https://photos.smugmug.com/photos/i-Rt2nWc/0/Th/i-Rt2nWc-Th.jpg"
    }
  ],
  "next_cursor": null
}
```

### list_orders

List your SmugMug orders with date, amounts and status, newest first. Access: read. REST: `GET /api/v1/smugmug/orders`. MCP: `smugmug_read → list_orders`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `status` | string | no | Filter: 'in_proof_delay' for orders you can still change, or 'all' (default). |
| `cursor` | string | no | Next page cursor from the previous call. |

Reads the orders in Selling Tools > Sales History. Each row has the order ID, date, currency, the price your customer paid, your estimated profit and the status. Orders in proof delay carry the badge In Proof Delay. Selling tools are part of Portfolio and Pro accounts.

Example response:

```json
{
  "orders": [
    {
      "order_id": "O-58213",
      "date": "2026-10-15",
      "currency": "USD",
      "price_charged": 84,
      "profit": 31.2,
      "status": "in_proof_delay"
    },
    {
      "order_id": "O-58190",
      "date": "2026-10-14",
      "currency": "USD",
      "price_charged": 25,
      "profit": 21.25,
      "status": "in_proof_delay"
    }
  ],
  "next_cursor": null
}
```

### get_order

Read what a customer ordered: prints and digital downloads, with quantities. Access: read. REST: `GET /api/v1/smugmug/orders/{order_id}`. MCP: `smugmug_read → get_order`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `order_id` | string | yes | Order ID from list_orders. |

Returns the choices your customer made, split into prints and digital downloads, with the filename and quantity of each item, the status and, for an order in proof delay, the time it is released automatically. It shows the order as in Order details. It does not change the order.

Example response:

```json
{
  "order_id": "O-58213",
  "status": "in_proof_delay",
  "auto_release_at": "2026-10-19T09:00:00+02:00",
  "items": [
    {
      "type": "print",
      "filename": "DSC_3026.jpg",
      "quantity": 2
    },
    {
      "type": "download",
      "filename": "DSC_3031.jpg",
      "quantity": 1
    }
  ]
}
```

### create_gallery

Create an empty gallery in a folder, Private unless you say otherwise. Access: write. REST: `POST /api/v1/smugmug/galleries`. MCP: `smugmug_write → create_gallery`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `title` | string | yes | Gallery title. |
| `folder_id` | string | no | Folder ID from list_galleries. Leave out to create it at the top of your site. |
| `description` | string | no | Gallery description. |
| `visibility` | string | no | One of 'private' (default), 'unlisted' or 'public'. |

Creates the gallery with the settings of the Create Gallery form and returns its ID and link. The gallery is empty and notifies no one, so it needs no confirmation. Change who can see it later with set_gallery_privacy. Creating a gallery in a Private folder keeps it Private.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "title": "Smith wedding",
  "folder_id": "Hm3vLq",
  "visibility": "private",
  "web_url": "https://studio.smugmug.com/Delivered-2026/Smith-wedding"
}
```

### upload_photos

Upload files from links into a gallery. Access: write, asks the user first. REST: `POST /api/v1/smugmug/galleries/{gallery_id}/photos`. MCP: `smugmug_write → upload_photos`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery ID from list_galleries. |
| `file_urls` | array | yes | HTTPS links to the files. Cotlet downloads each one and uploads it. |

Uploads each file into the gallery and returns the new photo IDs in the order you gave. If the gallery is Public or Unlisted, the files are visible to everyone who may open it. A file that SmugMug refuses is listed with the reason and the rest are still uploaded. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "uploaded": [
    {
      "photo_id": "Qm7xKd",
      "filename": "DSC_3025.jpg"
    },
    {
      "photo_id": "Rt2nWc",
      "filename": "DSC_3026.jpg"
    },
    {
      "photo_id": "Ys5pHe",
      "filename": "DSC_3027.jpg"
    }
  ],
  "failed": []
}
```

### update_photo_details

Set the title, caption or keywords of one or more photos. Access: write. REST: `PATCH /api/v1/smugmug/photo-details`. MCP: `smugmug_write → update_photo_details`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `photo_ids` | array | yes | Photo IDs from list_gallery_photos. |
| `title` | string | no | New title for every photo in photo_ids. |
| `caption` | string | no | Caption text, up to 65,000 characters. |
| `caption_mode` | string | no | How to treat an existing caption: 'replace' (default), 'before' or 'after'. |
| `keywords_add` | array | no | Keywords to add. Existing keywords stay. |
| `keywords_remove` | array | no | Keywords to remove from these photos only. |

Applies the same values to every photo in photo_ids and returns the previous caption of each, so a mistake is one call away from undone. It does not send anything to other people, so it needs no confirmation. On a public gallery the new text is visible to visitors and to search. Filenames cannot be edited.

Example response:

```json
{
  "updated": 2,
  "photos": [
    {
      "photo_id": "Qm7xKd",
      "filename": "DSC_3025.jpg",
      "caption": "Lakeview 10K, finish line.",
      "keywords": [
        "running",
        "lakeview",
        "finish line"
      ],
      "previous_caption": ""
    },
    {
      "photo_id": "Rt2nWc",
      "filename": "DSC_3026.jpg",
      "caption": "First dance Lakeview 10K, finish line.",
      "keywords": [
        "wedding",
        "running",
        "lakeview",
        "finish line"
      ],
      "previous_caption": "First dance"
    }
  ]
}
```

### set_gallery_privacy

Set the visibility and access of a gallery or folder. Access: write, asks the user first. REST: `PUT /api/v1/smugmug/galleries/{gallery_id}/privacy`. MCP: `smugmug_write → set_gallery_privacy`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery or folder ID from list_galleries. |
| `visibility` | string | no | One of 'public', 'unlisted' or 'private'. |
| `access` | string | no | One of 'password' or 'people_i_choose'. For people_i_choose, add people with invite_gallery_viewers. |
| `password` | string | no | Gallery password. Required with access password. |
| `password_hint` | string | no | Hint shown to visitors. |
| `include_galleries_inside` | boolean | no | For a folder: apply the setting to every gallery inside it, at any depth. Default false. |
| `update_direct_image_urls` | boolean | no | When switching to private: invalidate direct image links shared before. Irreversible. Default false. |

Changes who can open the gallery and returns how many galleries changed. Unlisted hides a gallery from navigation and search but anyone with the link can open it. A Private folder makes everything inside it Private. Updating direct image URLs stops every direct link shared before and cannot be undone. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "title": "Smith wedding",
  "visibility": "private",
  "galleries_changed": 1,
  "direct_image_urls_updated": false
}
```

### invite_gallery_viewers

Switch a gallery to People I Choose and email invitations to the addresses you give. Access: write, asks the user first. REST: `POST /api/v1/smugmug/galleries/{gallery_id}/viewers/invite`. MCP: `smugmug_write → invite_gallery_viewers`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery ID from list_galleries. |
| `emails` | array | yes | Email addresses to invite. |

Sends SmugMug invitation emails and returns the addresses invited and the total now invited to the gallery. Each guest accepts by email and signs up for a guest account if needed. One gallery, folder or page takes up to 200 invitations. Private sharing needs the Power plan or higher. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "gallery_id": "Xk4RtP",
  "access": "people_i_choose",
  "invited": [
    "anna@example.com",
    "tom@example.com"
  ],
  "total_invited": 2
}
```

### set_guest_upload_key

Turn on guest uploading for a gallery and get the link to share. Access: write, asks the user first. REST: `PUT /api/v1/smugmug/galleries/{gallery_id}/guest-upload-key`. MCP: `smugmug_write → set_guest_upload_key`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `gallery_id` | string | yes | Gallery ID from list_galleries. |
| `key` | string | yes | Letters and digits only. Guests can see it in the link. An empty value removes the key. |

Sets the Guest Uploading field under Security & Sharing and returns the upload link. Anyone with the link can upload into this gallery and only this gallery. Guests still need the viewing password for a password gallery, and an invitation for a People I Choose gallery, to see photos. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "gallery_id": "Zb6nTa",
  "guest_upload_key_set": true,
  "upload_url": "https://studio.smugmug.com/Events-2026/Mia-and-Leo-party?upload=mialeo2026"
}
```

### release_order

Release an order that is in proof delay so the lab starts printing it. Access: write, asks the user first. REST: `POST /api/v1/smugmug/orders/{order_id}/release`. MCP: `smugmug_write → release_order`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `order_id` | string | yes | Order ID from list_orders. |

Does what Release Order does: sends the order to the print lab, and emails your customer when downloads are ready. If you do not release it, SmugMug releases it automatically when the proof delay ends. Proof delay is for Portfolio and Pro accounts, and replacing photos or adjusting crops stays in the web app. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "order_id": "O-58190",
  "status": "released",
  "downloads_email_sent": true
}
```

## How do I connect SmugMug to Claude Code, Codex or Cursor?

Connecting SmugMug takes three steps: sign up, sign in to SmugMug once in your Cloud Browser and enable it for agents, then add one MCP server or call the REST API with the same key.

### Connect SmugMug to your agent.

1. **Create an account** Sign up and add SmugMug in the console. Your API key is there too.

2. **Sign in to SmugMug in your Cloud Browser** Open your Cloud Browser in the console: your own Chrome in the cloud. Sign in to SmugMug there yourself, the way you always do, then press Enable for agents, read only or read and write. We never save your password, and your agent keeps working even when your computer is off.

3. **Add Cotlet to your agent** Paste the snippet for your client. The same server and key serve every app you connect, so you do this once.

   Claude Code:

```
claude mcp add --transport http cotlet \
  https://cotlet.dev/mcp/v1 \
  --header "Authorization: Bearer $COTLET_API_KEY"
```

   Cursor:

```
{
  "mcpServers": {
    "cotlet": {
      "url": "https://cotlet.dev/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${COTLET_API_KEY}"
      }
    }
  }
}
```

   Codex:

```
# ~/.codex/config.toml
[mcp_servers.cotlet]
url = "https://cotlet.dev/mcp/v1"
bearer_token_env_var = "COTLET_API_KEY"
```

4. **Ask your agent** Ask in plain words. Your agent finds the SmugMug tools on the server and calls them for you; anything that reaches other people waits for your OK unless you switch that off for a tool.

```
Go through the folder "Delivered 2026" in SmugMug. Set every gallery that is not Private to Private, and tell me which ones you changed. Do not touch direct image URLs.
```

### Call SmugMug from your scripts.

1. **Export your API key** Your scripts use the same API key as your agent. Keep it in an environment variable, never in your code.

```
export COTLET_API_KEY="cotlet_..."
```

2. **Call a tool** Every tool is an endpoint under /api/v1/smugmug with its own method and path, listed with the endpoints above. Path parameters go in the URL; the other parameters go in the query for GET and DELETE and in a JSON body otherwise.

```
curl -X PATCH https://cotlet.dev/api/v1/smugmug/photo-details \
  -H "Authorization: Bearer $COTLET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"photo_ids":["Qm7xKd","Rt2nWc"],"caption":"Lakeview 10K, finish line.","caption_mode":"after","keywords_add":["running","lakeview","finish line"]}'
```

3. **Read the result** You get plain JSON back, ready for your script. A failed call costs nothing.

```
{
  "updated": 2,
  "photos": [
    {
      "photo_id": "Qm7xKd",
      "filename": "DSC_3025.jpg",
      "caption": "Lakeview 10K, finish line.",
      "keywords": [
        "running",
        "lakeview",
        "finish line"
      ],
      "previous_caption": ""
    },
    {
      "photo_id": "Rt2nWc",
      "filename": "DSC_3026.jpg",
      "caption": "First dance Lakeview 10K, finish line.",
      "keywords": [
        "wedding",
        "running",
        "lakeview",
        "finish line"
      ],
      "previous_caption": "First dance"
    }
  ]
}
```

## Why use Cotlet for SmugMug?

**Built for agents**

- One MCP server for every app you connect.
- The same tools as a REST API for scripts and cron jobs.
- Works with Claude Code, Codex and Cursor.

**Your login stays yours**

- You sign in to SmugMug yourself, in your own Cloud Browser. We never save your password; the profile is encrypted with AES-256-GCM, the cipher 1Password uses.
- A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory.
- The model never sees a login.
- No stored passwords, no CAPTCHA solving, no MFA bypass.

**You stay in control**

- Scope each API key: its apps, its tools, read only or read and write.
- Anything that reaches other people waits for your OK, so a leaked key cannot post or message as you.
- Every background request listed in your Background activity. Disable for agents in one click.

**Kept working for you**

- We test every integration every 6 hours.
- When SmugMug changes, the tool pauses until we fix it.
- Failed calls cost nothing.

## Is it safe to connect SmugMug to Cotlet?

Yes. You sign in to SmugMug yourself, in your own Cloud Browser, and we never save your password. Your agents only get SmugMug once you enable it, and every background request is listed. The browser profile is stored encrypted with AES-256-GCM, the same cipher 1Password uses for its vaults and Apple for iCloud Keychain. Independent public scanners grade cotlet.dev A+ and find it clean; click a result to rerun it yourself.

- **A+ on Qualys SSL Labs**: Encryption in transit: TLS setup and certificates, on all four server addresses. [Live result](https://www.ssllabs.com/ssltest/analyze.html?d=cotlet.dev)
- **A+ on securityheaders.com**: Browser protections sent with every page, all six headers present. [Live result](https://securityheaders.com/?q=cotlet.dev&followRedirects=on)
- **A+ on Mozilla Observatory**: Mozilla's web security baseline: score 120 of 100, 12 of 12 tests passed. [Live result](https://developer.mozilla.org/en-US/observatory/analyze?host=cotlet.dev)
- **Clean on Sucuri SiteCheck**: No malware, spam or defacement, and not on any of 9 blocklists, Google Safe Browsing included. [Live result](https://sitecheck.sucuri.net/results/cotlet.dev)

[How Cotlet protects your access](https://cotlet.dev/security.md)

### Common concerns

**Who runs Cotlet?**

Cotlet is run by Take Group, a Polish software company working since 2019. Take Group runs about 3,200 websites on its own systems and has its own DevOps team for infrastructure security. We built and used integrations like this inside the company for years before opening them as Cotlet.

**Is this an official SmugMug integration?**

No, Cotlet is independent of SmugMug. SmugMug's own API is too limited for this work. Cotlet works through your own SmugMug account, the way you use SmugMug in the browser, so you need no partner approval and no developer setup.

**What about client data and GDPR?**

Cotlet is run from the EU and follows the GDPR. Cloud Browsers run in Finland, a Tier 1 country in the ITU Global Cybersecurity Index 2024. Data passes through a call and is not kept after it.

**Can I start with read only?**

Yes. Enable the app for agents as read only, or make the API key read only, and anything that reaches other people waits for your OK unless you switch that off per tool.

**Is it reliable?**

Every Cotlet service is checked every 3 minutes from Europe, North America, Asia and Australia. The live results and any outage are public at status.cotlet.dev.

**How do I stop?**

Press Disable for agents next to SmugMug in your console: your agents lose access at once and you stay signed in. Signing out of SmugMug in the browser works too, and Reset browser deletes the whole profile.

## Is there a SmugMug MCP server on GitHub?

Yes. Community SmugMug MCP servers exist on GitHub, usually maintained by one person. You install one yourself, apply for an API key, run the OAuth sign-in, and fix it when SmugMug changes. Cotlet hosts the same kind of server for you, signs in as you, and our team keeps it working.

|  | GitHub MCP server | Cotlet |
|---|---|---|
| Setup | Clone the repo, apply for an API key, run the OAuth 1.0a sign-in, add the server to each MCP client | Sign up, sign in to SmugMug once, add one MCP server or API key |
| When SmugMug changes | It breaks until you or the maintainer fix it | Our team tests it daily and fixes it for you; failed calls are free |
| Your SmugMug access | API key and OAuth token in a file on your computer, readable by any program you run | Signed in inside your own Cloud Browser in the EU, profile encrypted, only for the apps you enable, disabled for agents in one click |
| When access expires | Tools fail until you sign in to the OAuth flow again by hand | Your Cloud Browser keeps you signed in; if SmugMug logs you out, your agent gets a link to sign in again |
| Upkeep | You update, monitor and debug it yourself | Nothing to host or update |
| Where it runs | Your computer, while it is on | Hosted: Claude Code, Codex, Cursor, n8n and scripts, also on a schedule |
| Price | Free, paid for with your time | Free 7-day trial, then pay-as-you-go credit packs, no subscription |

### Which one fits you

**Pick Cotlet if**

- you are not a developer, or you do not want to maintain a server
- you need it to keep working when SmugMug changes, without checking it yourself
- your agent or a script should run it on a schedule, also while your computer is off

**Pick an open-source server if**

- you are comfortable installing, updating and fixing it yourself
- you want your sign-in to stay on your own computer
- you only need it now and then, from one MCP client

## How much does the SmugMug API cost?

Free 7-day trial with 2,000 credits, no card needed. After that, the SmugMug API is pay as you go with no limit on apps: Credit packs from $29 for 5,000 credits, one-time, no subscription. A successful call uses 20 to 30 credits (25 for most tools, about $0.10 to $0.15), your Cloud Browser uses 50 credits a day while it has an app enabled for agents, however many apps that is, and an agent driving the browser itself uses 5 credits a minute. Credit packs stay valid for 12 months and stack, so unused credits carry over.

| Credits | Price, one time | Calls at 25 credits | Per 1,000 credits |
|---|---|---|---|
| 5,000 | $29 | 200 | $5.80 |
| 15,000 | $79 | 600 | $5.27 |
| 32,000 | $149 | 1,280 | $4.66 |
| 60,000 | $249 | 2,400 | $4.15 |

Only successful calls use credits; failed calls and timeouts cost nothing. At a balance of 0 calls pause, never a surprise charge. Authenticate with the `Authorization: Bearer` header. [See full pricing](https://cotlet.dev/pricing.md)

## How Cotlet holds your access

Cotlet hosts MCP servers and REST APIs for apps with no usable API. Your agent works in your own SmugMug account.

- **Company details:** Cotlet is run by Take Group sp. z o.o., a company registered in Poland. Its full address and registration numbers are in the Terms of service. [Terms of service](https://cotlet.dev/terms)
- **Your sign-in:** You sign in to SmugMug yourself, in your own Cloud Browser: a Chrome we run for you in the EU, one per app. We never save your password (password saving is off), the profile is stored encrypted with AES-256-GCM, and your agents get SmugMug only after you enable it. When SmugMug signs you out, your agent gives you a link to sign in again. [Security](https://cotlet.dev/security.md)
- **Revoking access:** Press Disable for agents next to SmugMug, sign out of SmugMug in your Cloud Browser, or reset the browser. Every background request is listed in your Background activity. Actions that reach other people wait for your OK unless you switch that off per tool.
- **What we never do:** Store passwords, solve CAPTCHAs or bypass MFA.
- **SmugMug's terms:** You use your own SmugMug account and stay responsible for following SmugMug's terms. Cotlet is independent and not affiliated with SmugMug. [Terms](https://cotlet.dev/terms)
- **Contact:** Questions about the company, security or an app: [contact@cotlet.dev](mailto:contact@cotlet.dev)

## Frequently asked questions

**How do I get access?**

Sign up free, open SmugMug in the console and press Request access. Then you create your API key and connect SmugMug there.

**Do I need to be technical?**

No. You sign in to SmugMug once in your Cloud Browser, a normal Chrome you open from the console, and paste one command into your agent, or one URL into n8n. Your agent can walk you through it. There is no server to install, update or fix.

**Is it safe to connect SmugMug to Cotlet?**

Yes. You sign in to SmugMug yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get SmugMug once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

**Is a hosted server safer than a local one? My SmugMug sign-in would leave my computer.**

On Cotlet you sign in inside your own Cloud Browser, which only you open, and its profile is stored encrypted with AES-256-GCM in the EU. Agents get only the apps you enable, and every background request is listed. A local server keeps your SmugMug cookie in a plain file on your computer, readable by any program you run, and stops when your computer is off.

**Why does Cotlet send requests instead of clicking in my browser?**

To be fast, Cotlet doesn't click through SmugMug's pages. It sends the same requests your browser would, from your browser's IP with its cookies, without opening a window. SmugMug sees the same browser and IP you signed in with, and every request is listed in your Background activity.

**What if someone gets my Cotlet API key?**

The key holds no SmugMug login or cookies, it only asks Cotlet to run a tool. It can call only the apps and tools you gave it, and a read-only key changes nothing. Anything that reaches other people, like posts, comments or messages, waits for your OK in the dashboard by default, so a leaked key cannot post or message as you. When you switch approval off for a scheduled job, give that job its own key limited to that one tool. Every call is in your activity log, and deleting the key ends access at once.

**Why a signed-in browser and not OAuth, like other integration platforms?**

SmugMug offers no OAuth token you can simply grant for these tools: its official API leaves them out or needs a developer app, a plan or an approval first (see the official API section above). That is why Cotlet sets the limits itself: per key, per tool, with your approval before anything reaches other people. Cotlet is run by Take Group sp. z o.o., an EU company (VAT PL6342984273).

**Do I need a SmugMug API key for Cotlet?**

No. Cotlet works through your own signed-in account, so you do not apply for a key or build an OAuth sign-in. SmugMug gives API keys to all current subscribers who apply (SmugMug Help: SmugMug API, checked 17 Oct 2026).

**Which SmugMug plan do I need to invite clients to a gallery?**

Private sharing with People I Choose is available on the Power plan and higher, up to 200 invitations per gallery, folder or page (SmugMug Help: Share photos privately with only people I choose).

**Can my agent release orders in proof delay?**

Yes, release_order does what Release Order does. Proof delay is a feature of Portfolio and Pro accounts and holds an order for one to seven business days, which you choose in the gallery settings (SmugMug Help: Use proof delay on customer orders).

**Can my agent post or send messages in SmugMug without asking me?**

No. Every call to upload_photos, set_gallery_privacy, invite_gallery_viewers, set_guest_upload_key or release_order waits for your OK by default. For scheduled automations you can switch confirmation off per tool in your dashboard, for example only for approvals. create_gallery, update_photo_details runs without asking, because it sends nothing to anyone and one call undoes it.

**Can I use the SmugMug API in n8n?**

Yes. Add https://cotlet.dev/mcp/v1 with your API key in n8n's MCP Client node, or call its endpoints under https://cotlet.dev/api/v1/smugmug from the HTTP Request node.

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.

## For AI agents: sign your user up

Is your user asking you to sign them up for Cotlet? You can do it for them, no account or key needed.

1. Read the fields and their allowed values: GET https://cotlet.dev/api/v1/access-requests
2. Ask the user for each value: email, apps, what you will do with them. If they leave the password to you, generate a strong one and show it to them.
3. Show the user what you will send, then POST it as JSON to https://cotlet.dev/api/v1/access-requests.

One call creates the account and sends the access request; we email the user when access is granted.