Which Authorization header does the Trickest API use?

Send Authorization: Token for a token created in the dashboard. JWTs issued by the login endpoints use Authorization: Bearer instead. The hosted MCP endpoint follows the same rule and answers 401 with WWW-Authenticate: Token realm="trickest-mcp" when the header is missing.

Is there a Trickest sandbox or test API?

No. There is no separate sandbox host, no mock mode, and no test-only key. Every call hits your real vault. Test safely by starting with GET requests, which change nothing, and by running workflows on the free Community plan, where execution happens on machines you attach yourself. The word "sandbox" in the Trickest docs means the container the in-app agent runs commands in, not an API test environment. See the Community plan.

Where is the Trickest OpenAPI spec?

At /openapi.json. It is OpenAPI 3.0.0 covering the platform REST API, with the same operations the docs API reference is generated from. Point your client generator at it directly.

Do I need MCP to drive Trickest from a coding agent?

No. MCP is one of four paths. The hosted endpoint at api.trickest.io/mcp gives Claude Code, Cursor, or Codex typed tools; the installer at trickest.io/integrate instead drops the Trickest skill plus the CLI into your agent's shell, which needs no MCP setup at all. Compare them in Agent integrations.

developers · api · mcp · cli · sdk

Everything you need to build on Trickest.

One token, one base URL, one hosted MCP endpoint. This page is the index: get a key, make a call, then pick the surface that fits your runtime.

Get an API token Quickstart

Your first Trickest API call

Three steps, no SDK required. Create a token in the app, send it as an Authorization header, read a paginated JSON body. Dashboard tokens use the Token scheme; JWTs from the login endpoints use Bearer.

curl · quickstart

# 1. Create a token: https://trickest.io/settings/api-keysexport TRICKEST_TOKEN=<your-api-token> # 2. Call the APIcurl -s "https://trickest.io/api/vault/workflows?page_size=5" \  -H "Authorization: Token $TRICKEST_TOKEN" # 3. Read the response# {#   "count": 12,#   "next": null,#   "previous": null,#   "results": [ { "workspace_id": "…", "workspace_name": "…" } ]# }

curl · hosted mcp

# Same token, JSON-RPC over Streamable HTTPcurl -s https://api.trickest.io/mcp \  -H "Authorization: Token $TRICKEST_TOKEN" \  -H "Content-Type: application/json" \  -H "Accept: application/json, text/event-stream" \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' # Without the header:# 401 + WWW-Authenticate: Token realm="trickest-mcp"

Lists are DRF-paginated with page and page_size. Runs are async: POST /api/runs returns 201 with a pending run you poll. API reference.

Every Trickest developer surface, addressed

The full table an integration needs — copy the value, follow the link. Machine-readable copies of this page live at /developers/llms.txt and /for-agents.md.

Get a Trickest API token: https://trickest.io/settings/api-keysSettings → API & CLI in the Trickest app. A long-lived personal token, not an OAuth flow. It authenticates the API, the CLI, the SDK, and MCP alike.
REST API base URL: https://trickest.io/apiJSON in, JSON out. Send `Authorization: Token <api-token>`; JWTs from the login flow use `Bearer` instead.
OpenAPI spec: https://trickest.com/openapi.jsonOpenAPI 3.0.0 for the platform API. Every path, body, and response the docs reference renders comes from this file.
API reference: https://trickest.com/docs/api-reference/introductionThe browsable reference: auth, pagination, and per-endpoint request and response shapes.
Hosted MCP endpoint: https://api.trickest.io/mcpStreamable HTTP MCP server, production-hosted. Header `Authorization: Token <api-token>`. There is no npm package and no self-hosted binary.
CLI: curl -fsSL https://trickest.io/install.sh | shStandalone binary. `export TRICKEST_TOKEN=<token>` then `trickest auth status`. JSON output when piped.
TypeScript SDK: npm install @trickest/sdkTyped `TrickestClient` over fetch. Keep it server-side. Never ship the token to a browser.
Agent skill: https://trickest.com/SKILL.mdA drop-in SKILL.md that teaches a coding agent when and how to drive Trickest.
Agent manual: https://trickest.com/for-agents.mdThe self-contained operating manual an agent fetches in one shot. Human version at /for-agents.
Site index for LLMs: https://trickest.com/llms.txtllmstxt.org routing index of every indexable page. /llms-full.txt inlines the content.
Auth summary: https://trickest.com/auth.mdHow authentication works in one page of markdown: token issuance, the two header schemes, and scope.
Pricing: https://trickest.com/pricing.mdPlans and what each includes, as markdown. Human version at /pricing.

Trickest MCP: one hosted endpoint

Point Claude Code, Cursor, or Codex at the production server and the agent discovers Trickest tools — library search, workflow graph reads, node edits, run execution, output reads. There is no npm package and no self-hosted binary to install.

mcp.json

{  "mcpServers": {    "trickest": {      "url": "https://api.trickest.io/mcp",      "headers": {        "Authorization": "Token <YOUR_TOKEN>"      }    }  }}

Static header auth only — Trickest has no OAuth authorization server and no dynamic client registration, so nothing to register and nothing to refresh. MCP overview.

Trickest from your shell, your code, or your agent

The same engine and the same token behind each one. Pick by where the integration point is, not by capability.

CLI

Standalone binary, trickest noun verb, JSON when piped. Set TRICKEST_TOKEN and run trickest auth status. CLI docs.

curl -fsSL https://trickest.io/install.sh | sh

TypeScript SDK

Typed TrickestClient over fetch — workflows, runs, database, sessions. Keep the token server-side. SDK docs.

npm install @trickest/sdk

Agent skill

Installs the Trickest skill into Claude Code, Cursor, or Codex and signs the CLI in — no MCP setup. Read the skill itself at /SKILL.md.

curl -fsSL https://trickest.io/integrate | sh

Testing against Trickest: what actually exists

There is no sandbox host, no mock mode, and no test-only key. Every call hits your real vault, so the safe path is explicit rather than simulated.

Start read-only. Every GET in the spec — /vault/workflows, /library/browse, /workflows/{id}/runs — changes nothing, so an integration can be built and verified before it ever executes a workflow.

Then run for real on the free Community plan: your own vault, your own self-hosted fleet, your own model key. Execution happens on machines you attach, which is as close to an isolated environment as the platform offers. Community plan.

One naming trap worth clearing: “sandbox” in the Trickest docs is the container the in-app agent runs commands in — a product feature, not an API test environment. Nothing about it gives you a throwaway API host.

questions

Frequently asked

Need the whole API? Open the reference.

Create one in the Trickest app under Settings → API & CLI (trickest.io/settings/api-keys). It is a long-lived personal token, not an OAuth client: there is no authorization server, no client registration, and no refresh flow. Export it as TRICKEST_TOKEN and the API, CLI, SDK, and MCP endpoint all accept it. Signed in? Open API & CLI settings.

Go deeper on one Trickest surface

This page is the index. Each surface has its own page with the details that do not belong in a quickstart.

Get an API token Open the API reference

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demo Explore the platform