API, webhooks and AI assistants (MCP)

Everything here lives under Developers in the dashboard. Only the account owner sees that tab, because an API key is a password to the whole account that keeps working after whoever created it has left.

API keys

1. Give the key a name you will recognise later (the tool it is for).
2. Tick only the scopes the tool needs: links:read, links:write, analytics:read, webhooks:write.
3. Copy the key straight away. It starts with pwm_live_ and is shown once — we keep only a fingerprint of it, so nobody (including us) can show it again.

• Revoke ends a key on the very next request.
• Each key may make 120 requests a minute; above that the API answers 429 with a Retry-After header.
• The list shows when each key was last used, so a forgotten key is easy to spot and revoke.

The REST API

Base URL https://plugwith.me/api/v1. Send the key as Authorization: Bearer pwm_live_…. Endpoints: GET /links, POST /links, GET|PATCH|DELETE /links/{id or slug}, GET /analytics, GET|POST /webhooks, DELETE /webhooks/{id}, and GET /me to check a key. Links follow exactly the same rules as in the dashboard — the same slug rules, the same plan limits.

Webhooks

Add an https URL and pick events: link.created, link.updated, link.deleted and clicks.daily_summary (yesterday's visits and clicks per link, sent once a day just after midnight UTC). Addresses on private networks or localhost are refused.

• Every delivery is signed: the X-Plugwith-Signature header is t=<unix time>,v1=<HMAC-SHA256> of <t>.<raw body> with your signing secret. Check it, and reject a timestamp older than five minutes.
• The signing secret is shown once, when you add the endpoint.
• Answer with any 2xx within five seconds. Anything else is retried — after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours — then marked failed. Retries carry the same event id, so you can ignore duplicates.
• Send test sends a signed ping right away and shows the result. The last deliveries are listed underneath.

AI assistants (MCP)

plugwith.me runs an MCP server at https://plugwith.me/mcp. Add it to an assistant that lets you set a request header, with Authorization: Bearer and one of your keys. The assistant can then list, create, change and delete links and read analytics — but only what the key's scopes allow. For Claude Code: claude mcp add --transport http plugwith https://plugwith.me/mcp --header "Authorization: Bearer pwm_live_…".

Frequently asked questions