Quick start
Get an agent talking to Sprkly in four steps.
- 1.Generate an API key in Sprkly Settings → API Keys. Keys are scoped and never expire.
- 2.Exchange the API key for a 24-hour JWT by calling POST /auth with your key.
- 3.Use the JWT as a Bearer token on every MCP request to POST /mcp.
- 4.Refresh the JWT before it expires — or re-exchange the same API key for a new one.
Authentication
MCP requests use a short-lived JWT obtained by exchanging your long-lived API key. The API key never expires and can be regenerated from Settings at any time.
POST /auth — Exchange API key for JWT
Send your API key to the auth endpoint. You get back a JWT, its expiry, your user ID, and the scopes granted by the key.
Request
{
"apiKey": "sk_live_xxx"
}
Response
{
"token": "eyJ...",
"expiresIn": 86400,
"userId": "user_...",
"scopes": ["sprkly:*"]
}
cURL example
curl -sS https://mcp.sprkly.app/auth \
-H "Content-Type: application/json" \
-d '{"apiKey": "sk_live_xxx"}'
Token refresh: The API key itself never expires, but the exchanged JWT is valid for 24 hours (expiresIn: 86400 seconds). Refresh before expiry by calling POST /auth again with the same API key. Each exchange produces a fresh JWT; old tokens remain valid until their natural expiry.
Example
Complete flow: exchange an API key for a JWT, list available tools, then call a specific tool.
# 1. Exchange API key for a 24h JWT
curl -sS https://mcp.sprkly.app/auth \
-H "Content-Type: application/json" \
-d '{"apiKey": "sk_live_xxx"}' \
| jq -r '.token' > /tmp/sprkly_token
TOKEN=$(cat /tmp/sprkly_token)
# 2. List available tools (JSON-RPC 2.0)
curl -sS https://mcp.sprkly.app/mcp \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"method": "tools/list",
"id": 1
}'
# 3. Call a tool — get account summary
curl -sS https://mcp.sprkly.app/mcp \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "sprkly_get_account_summary",
"arguments": {}
},
"id": 2
}'
The first call to tools/list returns the full tool schema including parameter definitions. Use tools/call to invoke any of the eight tools listed above.
Scopes & permissions
API keys are scoped to control what agents can do. The JWT inherits the scopes of the exchanged API key.
sprkly:*
Wildcard scope. Grants access to all MCP tools.
post:draft
Draft and validate post content. Read scheduling data.
approval:request
Submit posts for human approval. Read approval status.
Never expose API keys or JWTs in frontend code, screenshots, agent transcripts, or public repos. Treat them as server-side secrets.
Need help?
MCP access follows the same entitlement as API access. Contact Sprkly support if your account needs help setting up API keys or enabling approval workflows.