Authentication & API Keys

The MOST API is a single JSON-RPC 2.0 endpoint. You authenticate with an API key and call tools (send a message, create a contact, trigger a workflow, and more). Everything is scoped to your organization.

• Base URL: https://most.money/api/mcp
• Protocol: JSON-RPC 2.0 over HTTPS POST
• Auth header: Authorization: Bearer mst_<your-key>

Get an API key

Create a key from the dashboard (Settings → Developer), or via the API while signed in:

POST /api/mcp/keys        # (session-authenticated, from the dashboard)
→ { "api_key": "mst_9f3c…", "message": "Save this key — it is shown only once." }

The raw key is returned once — store it securely. Each organization has one active key; creating a new key revokes the previous one. Revoke with DELETE /api/mcp/keys.

Discover available tools

Call tools/list to get every tool with its JSON input schema:

curl https://most.money/api/mcp \
  -H "Authorization: Bearer mst_9f3c…" \
  -H "Content-Type: application/json" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "tools": [
      { "name": "send_message",   "description": "Send a message to a contact…", "inputSchema": { … } },
      { "name": "create_contact", "description": "Create a new contact…",        "inputSchema": { … } },
      { "name": "search_contacts","description": "Search and filter contacts…",  "inputSchema": { … } }
    ]
  }
}

Call a tool

Use tools/call with the tool name and its arguments. Results come back in the MCP content format — a text block whose text is the JSON result of the tool:

{ "jsonrpc": "2.0", "id": 2, "method": "tools/call",
  "params": { "name": "search_contacts", "arguments": { "query": "acme" } } }

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": { "content": [ { "type": "text", "text": "{ \"contacts\": [ … ] }" } ] }
}

On a tool error the result includes isError: true. Requests may be batched (a JSON array, up to 20).