Developer tutorial

Connect Fendsy to an MCP client.

Use the same server API key for Fendsy's Streamable HTTP MCP endpoint. Its tools come from the published API reference and follow the same scopes, validation, and rate limits.

1. Create the right key

In your workspace, open Settings → Developer and create a key with only the permissions the client needs. For Catalog, Audience, Templates, Campaigns, and workspace reports, leave all Local Studio permissions unchecked. That creates a workspace-wide key. A key with Local Studio permissions is bound to one Site and cannot call those workspace-wide operations.

Copy the key when it is shown. Existing keys cannot be widened or read back later; create a replacement if you need different access.

2. Add the remote server

  • Transport: Streamable HTTP
  • URL: https://api.fendsy.com/mcp
  • Authentication: Authorization: Bearer fdy_live_…

Choose your MCP client's remote HTTP server option, enter the URL, and add the bearer token in its private connection settings. Client configuration formats differ; use its remote server instructions. Keep the key out of prompts, public configuration, browser code, and shared logs. Revoking the key also revokes MCP access.

3. Check the tools

After connecting, ask the client to list Fendsy tools. You should see getV1CredentialsVerify and the operations allowed by your key. The developer-openapi MCP resource provides request and response schemas. Each tool calls a versioned API operation; writes need the documented request body and sometimes an idempotency key.

From a Bash server shell:

curl https://api.fendsy.com/mcp \
  -H "Authorization: Bearer $FENDSY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Or from PowerShell:

$headers = @{
  Authorization = "Bearer $env:FENDSY_API_KEY"
  Accept = "application/json, text/event-stream"
}
$body = @{ jsonrpc = "2.0"; id = 1; method = "tools/list"; params = @{} } |
  ConvertTo-Json -Compress
Invoke-RestMethod -Uri "https://api.fendsy.com/mcp" -Method Post -Headers $headers -ContentType "application/json" -Body $body

These commands list tools from a trusted server shell. The endpoint rejects browser-origin MCP requests.

If a call is denied

A 401 means the key is missing, expired, or revoked. A403 can mean the required scope is absent or the key is bound to one Site while the operation needs a workspace-wide key. Verify the key with this quickstart and check the operation in the API reference.