---
title: "Developer API and MCP - Workflow Functions"
description: "Manage and run functions from your own code over a REST API, or from an AI agent over MCP. API keys, endpoints, and how API runs differ from Flow runs."
canonical: "https://docs.workflow-functions.app/developer-api-and-mcp"
---

# Developer API and MCP

Everything you can do in the app, you can also do from your own code or from an AI agent. Workflow Functions exposes two surfaces: a **REST API** and an **MCP server**. Both live on the **Developer** page.

## API keys

Both surfaces authenticate with an API key. On the **Developer** page, under **API keys**, create a key and pick its level:

- **Read only** - list and read functions and runs.
- **Read & write** - also create, update, delete, and run functions.

The full key is shown **once**, at creation. Copy it then and store it securely; you cannot see it again. Keys are stored hashed, never in plain text, and you can revoke a key at any time.

Send the key as a Bearer token on every request:

```text
Authorization: Bearer ffk_your_key_here
```

Replace `ffk_your_key_here` with the key you created on the Developer page.

## REST API

The base URL is `https://flow-functions.k8s-gcp-prod.eu.codecreationlabs.cloud/api/v1` (also shown on the Developer page). The main endpoints:

| Method | Path | Purpose |
| --- | --- | --- |
| GET | `/api/v1/me` | Check auth and see your key's level |
| GET | `/api/v1/functions` | List functions |
| POST | `/api/v1/functions` | Create a function |
| GET | `/api/v1/functions/:id` | Get one function |
| PUT / PATCH | `/api/v1/functions/:id` | Replace or update a function |
| DELETE | `/api/v1/functions/:id` | Delete a function |
| POST | `/api/v1/functions/:id/run` | Run a function now |
| GET | `/api/v1/runs` | List runs |
| GET | `/api/v1/runs/:id` | Get one run |

A quick check that your key works:

```bash
curl https://flow-functions.k8s-gcp-prod.eu.codecreationlabs.cloud/api/v1/me \
  -H "Authorization: Bearer ffk_your_key_here"
```

```json
{ "authenticated": true, "shop": "your-store.myshopify.com", "level": "WRITE" }
```

## MCP server

The MCP server lets an AI agent (Claude, Cursor, VS Code, Gemini CLI, and others) manage and run your functions directly. On the Developer page, the **MCP** tab shows:

- The MCP server URL: `https://flow-functions.k8s-gcp-prod.eu.codecreationlabs.cloud/api/mcp`.
- A ready-to-copy connect command per client, with your key already inserted.

The MCP tools mirror the REST endpoints, and the tool set reflects your key's level: a read-only key exposes only read tools. All authentication and data handling stay server-side.

## API and MCP runs do not use your Flow quota

Runs you trigger through the REST API or MCP are recorded as **API** runs. Like manual test runs, they do **not** count against your plan's monthly run quota. Only runs triggered by Shopify Flow count. This makes the API safe to use for building, testing, and automation without eating into your allowance. See [Run history and troubleshooting](https://docs.workflow-functions.app/run-history-and-troubleshooting.md) for how run triggers appear in history.

## Bans and rate limits

The API enforces the same safety controls as the app. Requests are rate limited, keys are level-enforced on every call, and a suspended store cannot run functions over the API any more than it can from Flow.

## Next steps

- [How to create a function](https://docs.workflow-functions.app/how-to-create-a-function.md) - the function model the API operates on.
- [Run history and troubleshooting](https://docs.workflow-functions.app/run-history-and-troubleshooting.md) - inspect API-triggered runs.