Lesson 1 / 97 min read

API & MCP: manage your account from Claude Code and OpenAI

Create a key, connect to the MCP server; list projects, start builds, edit data and images — without opening the console.

DevAny has an MCP (Model Context Protocol) server and its REST twin. Claude Code, OpenAI's Responses API or any HTTP client use the same tool set: projects, builds, publishing, records, images, checks and — for admin accounts — platform settings.

A key acts as your account and is limited to the scopes you grant. The build scope can spend credit; content edits are free and live at once.

Connect

1
Create a key
Settings → API & MCP. Name it, pick scopes, optionally set an expiry. The key is shown once.
2
Claude Code
Paste the ready command: claude mcp add --transport http devany https://devany.ai/api/mcp --header "Authorization: Bearer dk_…"
3
OpenAI
In the Responses API add it as a type:'mcp' tool with the same url and Authorization header; for Custom GPT Actions import the /api/v1/openapi document. That document is the "small business pack", sized for the GPT Actions limit (at most 30 operations); use ?pack=content for content work or ?pack=developer for an agent that works from the catalog.
4
Cursor, VS Code, Claude Desktop
In Settings → API & MCP tap Cursor or VS Code: the 'Open' button opens the editor's own 'install MCP server' dialog. For Claude Desktop the screen gives a ready block to paste into claude_desktop_config.json (the mcp-remote bridge, needs Node.js).
5
First call
capabilities: version, recent changes and the tools your key can see.

ChatGPT and Claude connectors: Sign in with DevAny

1
Server URL
https://devany.ai/api/mcp — no key needed; the connector takes you to DevAny's consent screen (OAuth 2.1, PKCE).
2
Claude.ai / Claude Desktop
Settings → Connectors → 'Add custom connector'; name DevAny, the URL above. Tap 'Connect', sign in on DevAny and approve. Desktop uses the same account's connectors.
3
ChatGPT
Settings → Apps & Connectors (if there's no 'Create', turn on Developer mode under Advanced settings). Create: name DevAny, MCP server URL above, authentication OAuth.
4
The consent screen
You see the app's name, where the answer goes and the permissions it asks for; you can narrow the permissions and you pick one workspace. The admin permission can never be given to a connection.
5
Disconnect
Settings → Connected apps → 'Disconnect'. The app loses access within a minute.

OpenAI Responses API

json

{
  "model": "gpt-5",
  "tools": [{
    "type": "mcp",
    "server_label": "devany",
    "server_url": "https://devany.ai/api/mcp",
    "headers": { "Authorization": "Bearer dk_…" },
    "require_approval": { "never": { "tool_names": ["capabilities", "api_catalog", "api_read", "list_projects", "get_project", "build_status", "polish_check"] } }
  }],
  "input": "List my projects and run a polish check on the first one."
}

Everyday work, with ready tools

	Tools	Spends credit
New project	list_design_directions → create_project (language, design direction, accent); or list_showcase_templates → copy_from_showcase (paid plan)
Build	build_project, build_status, cancel_build (need confirmation)
A long or unclear brief	Smart Build: plan_build (questions, then a phased plan with an estimate — builds and minutes) → approve_plan (the customer names it; the core build starts) → build_next_phase for each phase. All need confirmation.
Publishing and access	publish_project, set_visibility (public / password), set_domain → verify_domain, domain_status (with the DNS records)
Content	list_page_texts → edit_page_text (text without a build), upload_image → replace_image, set_record_field
Customers	list_leads (form submissions), list_appointments → appointment_action (approve, decline, cancel, no-show, reschedule)
SEO	seo_check is free; seo_fix writes the title and description with AI (needs confirmation)
Plan	plan_info reads; upgrade_link returns the page the customer opens and pays on — nothing is ever bought through the API

Heads up

Spending and deleting calls need a confirmation

A call that spends credit (builds, AI tools), deletes something (every DELETE) or runs a bulk / team / project-transfer action is refused on the server when made with a key — whatever the path. On MCP and REST tools the call must carry confirm: true, and the agent is told to set it only after you agreed. An unconfirmed call gets the same answer at every door: HTTP 428 with error: confirm_required (and a risk field) — on the REST tool route, and in the isError result over MCP. On plain HTTP with a key that answer also carries a confirmation token; repeat the identical request with the header x-devany-confirm: <token> within 5 minutes. Deleting a project with a key or a connection moves it to Trash (taken offline, kept with its data, restorable with restore_project or Projects → Trash; Trash is kept until you empty it, there is no automatic purge); a permanent delete needs permanent: true and applies only to a project already in Trash. It is a deliberate second step, not a second credential. In OpenAI, switch require_approval off for the read-only tools only, never for all of them.

List projects in an agency workspace (curl)

bash

curl -s https://devany.ai/api/v1/tools/list_projects \
  -H "Authorization: Bearer dk_…" -H "X-DevAny-Workspace: <workspace id>" \
  -H "content-type: application/json" -d '{}'

REST twin (curl)