Let AI assistants run your posting queue.

Quick start

Two ways to authenticate. Pick by what your client supports.

curl -s https://sprkly.app/api/mcp \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Transport

Streamable HTTP, stateless. JSON-RPC 2.0 messages are POSTed to a single endpoint and answered with application/json. No session id is issued, so there is nothing to track between calls.

Protocol versions

Negotiated on initialize: the server echoes your revision when it supports it, otherwise it answers with its newest. Supported: 2025-11-252025-06-182025-03-26. Send the negotiated value as MCP-Protocol-Version on subsequent requests — an unsupported value is a 400.

Methods

initialize, ping, tools/list, tools/call, resources/list and prompts/list (both empty). Notifications are acknowledged with 202 and no body.

Authentication

initialize, ping and tools/list work without credentials, so a client can show what Sprkly offers before anyone signs in. The first tools/call is challenged.

The 401 challenge

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
  error_description="Missing bearer credentials",
  resource_metadata="https://sprkly.app/.well-known/oauth-protected-resource/api/mcp",
  scope="profile mcp:read mcp:write"

Follow resource_metadata to learn which authorization server to use. That document names this origin, whose metadata lives at https://sprkly.app/.well-known/oauth-authorization-server.

OAuth 2.1

• Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents are both supported. PKCE with S256 is required.
• Scopes: profilemcp:readmcp:write. Add offline_access for a refresh token.
• mcp:read covers every read-only tool; mcp:write adds drafting, scheduling and deleting.

API key scopes

A key can hold *, sprkly:*, or any of post:read, post:write, post:draft, account:read, approval:request. A key scoped to specific accounts only ever sees and touches those.

Tools

13 tools. Arguments below are exactly what tools/list returns.

Client setup

The full walkthrough for each client lives on the integrations page. The short version:

https://sprkly.app/api/mcp

https://sprkly.app/api/mcp

claude mcp add --transport http sprkly https://sprkly.app/api/mcp

https://sprkly.app/api/mcp

{
  "mcpServers": {
    "sprkly": {
      "url": "https://sprkly.app/api/mcp"
    }
  }
}

{
  "servers": {
    "sprkly": {
      "type": "http",
      "url": "https://sprkly.app/api/mcp"
    }
  }
}

curl -s https://sprkly.app/api/mcp \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Worked example

Initialize, list the tools, then schedule a post. Substitute your own credential.

TOKEN="sk_live_…"
MCP="https://sprkly.app/api/mcp"

# 1. Initialize (no credentials needed)
curl -s "$MCP" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-11-25",
                 "capabilities":{},
                 "clientInfo":{"name":"curl","version":"1.0"}}}'

# 2. Which accounts can I post to?
curl -s "$MCP" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"sprkly_list_profiles","arguments":{}}}'

# 3. Check the caption before committing to it
curl -s "$MCP" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call",
       "params":{"name":"sprkly_validate_post_policy",
                 "arguments":{"caption":"Launch day.",
                              "platforms":["instagram"],
                              "mediaUrlsCount":1}}}'

# 4. Queue it
curl -s "$MCP" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call",
       "params":{"name":"sprkly_schedule_post",
                 "arguments":{"caption":"Launch day.",
                              "profile_ids":["profile_…"],
                              "media_urls":["https://example.com/launch.jpg"],
                              "scheduled_time":"2026-08-04T18:00:00.000Z"}}}'

Discovery

Machine-readable descriptions of this server, for agents that find it on their own.

• MCP manifest/.well-known/mcp.json
• Server card (SEP-1649)/.well-known/mcp/server-card.json
• Protected resource metadata/.well-known/oauth-protected-resource/api/mcp
• Authorization server metadata/.well-known/oauth-authorization-server
• API catalog (RFC 9727)/.well-known/api-catalog
• Auth instructions/auth.md

Deprecated

These still work. Nothing new needs them.

• https://mcp.sprkly.app/mcp — proxies to the endpoint above. Point new integrations at https://sprkly.app/api/mcp instead.
• POST /auth and POST /api/auth/mcp-token — the API-key-to-JWT exchange. The API key is now accepted directly as a bearer token, so the exchange and its 24-hour refresh loop are unnecessary.