Read API, OAuth, and MCP

Site read keys

Create a key under Website settings → API & MCP. The plaintext key is shown once and stored by RevenueUI only as a SHA-256 hash. Keys are scoped to one website and can independently allow analytics, Live, and Web Vitals reads.

Send the key as Authorization: Bearer rui_read_... to:

• GET /api/v1/read/analytics
• GET /api/v1/read/realtime
• GET /api/v1/read/web-vitals

MCP

Use POST /api/mcp as a Streamable HTTP JSON-RPC endpoint with the same bearer key. The server exposes get_analytics, get_realtime, and get_web_vitals tools. A key never grants writes or access to raw identifiers.

OAuth 2.0 with PKCE

Register an app name and exact HTTPS redirect URI in API & MCP settings. Public clients use Authorization Code with S256 PKCE; RevenueUI does not issue a client secret. The owner approves the read-only abilities, the authorization code expires after 10 minutes and is single-use, and the resulting access token expires after 30 days.

Use the frontend /oauth/authorize URL for authorization and POST /api/oauth/token for the code exchange. Deleting the OAuth client also revokes keys issued to that client.