Quickstart

Give an AI agent or third-party tool scoped, revocable control of one Wakato Space. One token, two surfaces:

MCP — for Claude Code, Cursor, Claude Desktop (/functions/v1/space-mcp)
REST — for everything else (/functions/v1/space-api)

Env	Base
Production	`https://api.wakato.io/functions/v1`
Development	`https://pnwxrleocjbcvrrwrycq.supabase.co/functions/v1`

1. Mint a key

In the app: Space → Settings → API Keys → New API key.

Name it (e.g. "Claude Code").
Choose an expiry (or No expiry).
Tick the scopes you want to grant. Each domain has up to three actions:
- Read — list / inspect
- Write — create / edit (drafts)
- Run — the live action: publish a page, send an SMS, post socially, run an automation. Grant deliberately.
Create and copy the token (wks_live_…). It's shown once.

A key is locked to that one Space. It can never touch another Space, move money, read secret values, manage members, or connect new accounts.

Tip

Start least-privilege. "Pages: Read + Write" lets an agent build pages without being able to publish them live.

2a. Connect over MCP (Claude Code, Cursor)

The MCP server self-describes its tools — once connected, the agent discovers everything via tools/list. You only need the URL + your key.

.mcp.json (Claude Code)

{
  "mcpServers": {
    "wakato": {
      "type": "http",
      "url": "https://api.wakato.io/functions/v1/space-mcp",
      "headers": { "Authorization": "Bearer wks_live_YOUR_TOKEN" }
    }
  }
}

Cursor (.cursor/mcp.json) uses the same shape. Then just ask: "List my open tasks", "Build a pricing page with a contact form", "Draft a LinkedIn post about our launch."

2b. Call over REST

KEY="wks_live_YOUR_TOKEN"
BASE="https://api.wakato.io/functions/v1/space-api"

# List pages
curl "$BASE/pages" -H "Authorization: Bearer $KEY"

# Create a page
curl -X POST "$BASE/pages" \
  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"title":"Launch","layout_html":"<section><h1>Hello</h1></section>"}'

# Publish it (needs the pages:run scope)
curl -X POST "$BASE/pages/PAGE_ID/publish" \
  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" -d '{}'

Code	Meaning
`200` / `201`	Success
`401`	Missing or invalid key
`403`	The key lacks the required scope for that operation

See the API Reference for every endpoint and its required scope.

3. What an agent can do

Domain	Read	Write	Run
Contacts, Tables, Audiences	✓	✓	—
Pages, Forms, Booking, Blog	✓	✓	publish
Calendar, Tasks	✓	✓	—
Documents, Whiteboards, Meet	✓	✓	create meeting
Assets (media, characters)	✓	✓	generate media
Social	accounts/analytics	draft posts	publish/schedule
Inbox / DMs	threads/messages	—	reply
Phone	numbers/calls/campaigns	draft SMS campaigns + 10DLC registration	send SMS, run campaign
Agent Mail	addresses/campaigns/templates	send email, draft campaigns	send/start campaign
Commerce	products/orders/buyers, payment readiness	listings, invoices, payment links, jobs	—
Wakato Pass	passes/holders	create/edit passes	issue/redeem
Ads	accounts/campaigns/results	ad recipes, launch inside the account's agent budget	—
External Reach	✓	✓	—
Apps (build Space Apps)	✓	build code/schema	publish
Automations	✓	✓	run
Services (web search, scraping, research)	catalog	—	invoke
Space Settings	✓	localization	—
Finance	✓	keep the books (sort, receipts, bills, month end)	—
Wallet	✓	—	—
Integrations	✓	ask a person to connect an API	—
Secrets	names only	—	call external APIs

This is the shape, not the whole list. See MCP Tools for the complete, per-scope reference of every space tool — generated from the code, so it's always current.

4. Safety model

One Space. A key cannot reach another Space, the user's login, member permissions, or other users.
Draft-first. Posting, sending, launching, and publishing are separate run scopes — write lets an agent prepare, not go live.
Books, not bank transfers. Finance write keeps the books (sorting, receipts, bills, month end); no key can send money out of the space. Spending tools (ads, paid services) stay inside the space's caps and ask-first rules.
Secrets stay secret. Only names/labels are listed; values live in Vault.
Accounts stay yours. Connecting new social/OAuth accounts requires you.
Revocable. Delete the key and the connection is gone immediately.

5. Realtime

Changes an agent makes through this API appear live in an open Wakato tab (Pages, Contacts, Tasks, Documents, Calendar, Forms, Booking, Social) — no refresh needed.