Connect an assistant with MCP

Check the client before connecting

Vouched currently exposes JSON-RPC 2.0 over HTTP POST at /api/mcp. Your client must support this transport and a custom Authorization: Bearer header. Copy the endpoint URL from Developers.

There is no OAuth consent flow, browser sign-in connector or server-sent event stream here. A client that requires those features may not connect. Listing the tools does not prove an authenticated tool call works.

Make a read-only connection

Use a brand API key created in Developers. Keep it in the client's secure credential configuration, not in an ordinary chat message or public configuration file.

1. Set the endpoint to your Vouched origin followed by /api/mcp.
2. Configure Authorization: Bearer with your brand API key.
3. Initialize the connection, list the tools and call list_campaigns to verify actual data access.
4. Check that the returned records belong to the intended brand before letting the assistant use them.

Six read tools, one brand

list_campaigns, list_submissions, list_payouts, list_deposits, list_conversions and list_links use the same brand access and rate limit as the Read API. Their optional arguments are limit, cursor and since, and next_cursor comes back in the result the same way.

Useful prompts include: summarize these campaign records, identify submissions with pending status, or explain the payout statuses returned. The assistant only knows the records actually retrieved; an incomplete result is not a complete business report.

curl --fail-with-body "$VOUCHED_ORIGIN/api/mcp" \
  -H "Authorization: Bearer $VOUCHED_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_campaigns","arguments":{"limit":50}}}'

Prepare a campaign for human review

Brand Plus and above can opt into campaigns:prepare when an owner creates a live key. Reporting keys retain their existing permissions. Call prepare_campaign_plan with request_id (a new UUID), title, goal, campaign_type, planned_for, review_on and planning_budget in PHP. Optional creative fields are summary, brief, requirements and platforms. Notes stay private.

The formats are blitz for clipping, ugc for original content, package for influencers and affiliate for tracked promotion. Open the returned review_path in the matching workspace. The wizard prefills editable fields, while the brand confirms pay, rights and funding. Nothing publishes automatically.

Reuse the same request ID and identical input on retries, including after key rotation. Changed input or a cancelled plan returns request_conflict with isError over MCP, or HTTP 409 over REST. Up to 200 pending agent-prepared plans are allowed per brand. The full schema is at /openapi/vouched.yaml; the same contract works with POST /api/v1/campaign-plans.

Read the tool result, not just the HTTP status

A tool call can return HTTP 200 with isError for validation or business refusals. Also handle HTTP 401 for missing or invalid keys, 403 for access refusals and 429 for throttling. Honor Retry-After and check the response before assuming success.

An assistant cannot fund campaigns, approve submissions or release payouts through these tools. Review its interpretation against the dashboard and the underlying records. Remove or revoke a key when you stop using the client.

Common questions