Public API & MCP
Connect Claude, ChatGPT, n8n or your own code to your workspace
Poplitu has one public surface for everything outside the app: a REST API and an MCP server, both behind the same keys, scopes and limits. An AI assistant such as Claude or ChatGPT connects to the MCP server; a script, a CLI or n8n calls the REST API. Both reach the same tools.
Where it lives
Both are served by your workspace's API host, under /api/public/v1:
| What | Address |
|---|---|
| MCP server (Streamable HTTP) | /api/public/v1/mcp |
| Tools: list | GET /api/public/v1/tools |
| Tools: run one | POST /api/public/v1/tools/{name} |
| Who you are, and your plan | GET /api/public/v1/me |
| AI credits left | GET /api/public/v1/credits |
| Writes waiting for a person | GET /api/public/v1/proposals |
| Service status | GET /api/public/v1/status |
Signing in
There are two ways in, and a request sends either one as
Authorization: Bearer <token>.
An API key, for your own code. Create one in Console → API keys, pick the scopes it may use, and copy it once: it is not shown again.
OAuth, for an assistant you connect. Claude and ChatGPT find everything
they need on their own: the MCP server answers a request with no token with a
401 that points at its metadata (/.well-known/oauth-protected-resource),
and the authorization server publishes its endpoints at
/.well-known/oauth-authorization-server. Sign-in uses OAuth 2.1 with PKCE
(S256). A client can register itself (dynamic client registration) or name
itself by a client ID metadata document. You approve the connection on a
consent screen in Poplitu that lists exactly what it may do.
A connection reaches only its own workspace, and only what its scopes open.
What a connected assistant can do
What the connection can do follows from its scopes.
Every write it makes waits for a person to approve it unless the connection
holds mutate:auto (see Proposals). When
something goes wrong, the answer says what happened, what to do next, and
links to the page here that explains it.