Authentication

Bearer auth

Every request to /mcp requires a bearer header. The token is generated once and only its hash is stored.

Creating a token

curl -X POST https://anymrkt.com/api/mcp/tokens \
  -H "Authorization: Bearer PLACEHOLDER" \
  -H "Content-Type: application/json" \
  -d '{"brandIds":["brand-uuid"],"label":"x","scope":"manage","permissions":["listings","content"]}'

The response includes the plaintext token exactly once.

Token fields

Field	Type	Description
`brandIds`	string[]	Brands this token can access.
`label`	string	Human-readable name.
`scope`	string	view, manage, or bookings.
`permissions`	string[]	Fine-grained permission scopes.
`toolFilters`	string[] \| null	Allow-list of tool names.
`jwk`	object \| null	JSON Web Key for DPoP binding.

Default permissions: listings, availability, pricing, content

Valid: listings, availability, pricing, content, scheduling, conversation, run, webhooks

DPoP binding

Pass a jwk at creation to bind the token via DPoP. A stolen bearer token is useless without the private key.

Permissions

Listings (listings)

Create and edit what you sell.

Reads	Writes	Cannot
Your listings, including drafts, prices and stock	Create a listing Edit a listing’s details Publish a draft Delete a listing Connect a channel a listing is distributed through	Take payment or issue a refund Change where your money goes

Tools: list_listings, get_listing, create_listing, update_listing, publish_listing, delete_listing, connect_channel

confirm required

Availability (availability)

Change when a listing can be booked.

Reads	Writes	Cannot
The dates and windows a listing is open	Open or close dates on a listing	Cancel a booking someone has already made See an attendee’s contact details

Tools: update_availability

Pricing (pricing)

Change what you charge.

Reads	Writes	Cannot
Current prices and any seasonal rates	Set a listing’s price	Charge anyone Alter an order that has already been placed

Tools: update_pricing

Content and your page (content)

Write your brand page and its wording.

Reads	Writes	Cannot
Your brand details, and your page — draft and live	Your brand description and theme Everything on your page: sections, wording, photos, layout and colours Publish the page, but only when told to explicitly	Change your web address Delete your brand Publish without an explicit confirmation

Tools: update_content, builder_describe, builder_get_page, builder_validate_page, builder_apply_template, builder_patch_page, builder_publish_page, managed_brand_provision, managed_brand_invite

confirm required

Scheduling (scheduling)

Set up meeting types and manage bookings.

Reads	Writes	Cannot
Your meeting types, opening hours and settings Your bookings, including the name and email of whoever booked	Create and edit meeting types, their length, price and buffers Set the hours you are free Change your timezone, notice period and how far ahead people can book Cancel a booking, but only when told to explicitly	Read your connected calendar, or the events in it Add or remove a calendar connection Take payment for a meeting

Tools: scheduler_describe, scheduler_list_meeting_types, scheduler_open_slots, scheduler_list_bookings, scheduler_create_meeting_type, scheduler_update_meeting_type, scheduler_set_availability, scheduler_set_settings, scheduler_cancel_booking

confirm required

Messages (conversation)

Read your conversations with buyers.

Reads	Writes	Cannot
Message threads with buyers		Send a message as you Delete a thread

Tools: list_conversations

Undo (run)

Undo a whole session of an agent’s changes.

Reads	Writes	Cannot
The log of what agents changed	Put back everything one agent session changed	Undo anything you did yourself

Tools: revert_run

Webhooks (webhooks)

Send a brand’s events (orders, publishes) to a URL.

Reads	Writes	Cannot
Which webhook destinations exist for your brands	Create a destination that sends one brand’s chosen events to an HTTPS URL	Create an account-wide destination — only you can, signed in Send events from a brand this token was not given See the signing secret of a destination it did not create

Tools: studio_create_event_destination

Never permitted (FR36)

Change where your payouts go
Accept legal or policy terms on your behalf
Delete your brand
See your password, your payout details, or any card number