Authentication

The REST API and the MCP server expose the same operations as the dashboard: apps, releases, payment integrations and license keys. Every endpoint is listed in the API reference.

API keys

  1. Sign in and open Settings → API Keys (also in the avatar menu).
  2. Press Create API Key, enter a name and, optionally, an expiry in days.
  3. Copy the key. It starts with rf_ and is shown only once.

A key acts as your account, with the same access as the dashboard. Keep it in a secret store or environment variable, never in a public repository or in an app you ship. Revoke a key on the same page; it stops working immediately.

REST

Base URL: https://releaseflow.net/api/rest. Send the key in the x-api-key header:

curl https://releaseflow.net/api/rest/apps \
  -H "x-api-key: $RELEASEFLOW_API_KEY"

Request and response bodies are JSON. Write requests need Content-Type: application/json:

curl -X POST https://releaseflow.net/api/rest/apps/APP_ID/sync \
  -H "x-api-key: $RELEASEFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

In the API reference, press Authorize and paste the key to try requests from the browser. The raw OpenAPI document is at /api/openapi.json.

MCP

Endpoint: https://releaseflow.net/api/mcp (Streamable HTTP). Tools are generated from the REST API, so every endpoint in the reference is also an MCP tool. Read-only tools need the releaseflow:read scope; tools that change data need releaseflow:write.

Two ways to authenticate. OAuth (recommended): add the URL with no credentials; the client opens a ReleaseFlow sign-in and consent page and stores the token. API key: send Authorization: Bearer rf_… or x-api-key: rf_… with every request. API keys have both scopes.

Claude Code

claude mcp add --transport http releaseflow https://releaseflow.net/api/mcp

Then run /mcp in Claude Code, select releaseflow and authenticate in the browser. With an API key instead:

claude mcp add --transport http releaseflow https://releaseflow.net/api/mcp \
  --header "Authorization: Bearer $RELEASEFLOW_API_KEY"

Claude (desktop and web)

Open Settings → Connectors → Add custom connector, name it ReleaseFlow, paste https://releaseflow.net/api/mcp as the URL and press Connect to sign in.

Cursor

Add the server to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project), then press Connect next to it in Settings → MCP to sign in:

{
  "mcpServers": {
    "releaseflow": {
      "url": "https://releaseflow.net/api/mcp"
    }
  }
}

With an API key instead:

{
  "mcpServers": {
    "releaseflow": {
      "url": "https://releaseflow.net/api/mcp",
      "headers": {
        "Authorization": "Bearer rf_YOUR_KEY"
      }
    }
  }
}

Other clients

Clients that support remote MCP servers with OAuth discover the sign-in flow from /.well-known/oauth-protected-resource and register themselves automatically. Clients without OAuth support can send an API key header as above.

Errors

  • REST 401 UNAUTHORIZED: the x-api-key header is missing, or the key is wrong, revoked or expired.
  • MCP Authentication required: the tool call had no valid token or key, or the OAuth token lacks the scope the tool needs. Reconnect the server to sign in again.