NewManage your creative team from your own apps with the Flocksy API, or from Claude and other AI assistants. Learn more →
Integrations & API · developer quickstart

Ten tools. One header. No surprises.

Connect an assistant or your own code to a dedicated Flocksy creative team in five steps. The Flocksy API is an MCP server with ten tools to brief, track, revise and approve work. People do the work, so expect hours, not milliseconds.

Requires a 4+ Daily Hour plan. Reference material follows the quickstart.

  1. 01

    Create a key

    An owner or admin opens Settings, API Keys in the Flocksy account and creates a key. Choose view-only, or allow-changes to brief and approve. Add an optional expiry. The key is shown once, so store it in a secret manager.

    Shell
    export FLOCKSY_URL="<CONNECTION URL from Settings → API Keys>"
    export FLOCKSY_API_KEY="flk_live_..."
  2. 02

    Connect an assistant (optional)

    In Claude, go to Settings, Connectors, Add custom connector. Any assistant with custom MCP connector support works the same way. Use the connection URL and send the key in the Authorization header.

    MCP client config
    "mcpServers": {
      "flocksy": {
        "url": "<CONNECTION URL from Settings → API Keys>",
        "headers": {
          "Authorization": "Bearer flk_live_..."
        }
      }
    }
  3. 03

    Test the key

    Call whoami. It changes nothing and returns your organization, plan, Daily Hours, hours used today, the trial flag and this key's permissions.

    curl · whoami
    curl -X POST "$FLOCKSY_URL" \
      -H "Authorization: Bearer $FLOCKSY_API_KEY" \
      -H "Content-Type: application/json" \
      -H "Accept: application/json, text/event-stream" \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
           "params":{"name":"whoami","arguments":{}}}'
  4. 04

    List the tools you can use

    tools/list returns each tool with its current input schema. A view-only key is never shown the write tools.

    curl · tools/list
    curl -X POST "$FLOCKSY_URL" \
      -H "Authorization: Bearer $FLOCKSY_API_KEY" \
      -H "Content-Type: application/json" \
      -H "Accept: application/json, text/event-stream" \
      -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
  5. 05

    Read your projects

    list_projects returns your requests, newest first, filtered by status if you like. From here, create_project briefs the team using the schema from step 4.

    curl · list_projects
    curl -X POST "$FLOCKSY_URL" \
      -H "Authorization: Bearer $FLOCKSY_API_KEY" \
      -H "Content-Type: application/json" \
      -H "Accept: application/json, text/event-stream" \
      -d '{"jsonrpc":"2.0","id":3,"method":"tools/call",
           "params":{"name":"list_projects","arguments":{"limit":10}}}'
Getting updates

Your integration asks. Flocksy doesn't push.

There are no outgoing webhooks. Your integration asks Flocksy for updates rather than being notified: check list_projects or get_project on a schedule and act on status changes. Monday.com is the exception, because Flocksy checks that board itself about every five minutes.

Reference · authentication

Bearer token in the header. Never in the URL.

  • Endpoint: your connection URL, copied from Settings, API Keys.
  • Header: Authorization: Bearer flk_live_...
  • A key in a URL is rejected outright.
  • Keys are stored only as a SHA-256 hash. Flocksy cannot show a key again, so store it in a secret manager or connector settings.
Key lifecycle

Create, scope, expire, revoke.

Create

Owners and admins create keys in the Flocksy account under Settings, API Keys. Each key is random, 40 characters, prefixed flk_live_, and shown once.

Scope

Choose view-only, or allow-changes (which also reads). Scope is fixed per key.

Expire

Optional expiry from 1 to 730 days.

Revoke

Revoke instantly. Owners and admins are emailed on every create and revoke.

Cap

Up to 20 active keys per organization.

Follow the person

A key stops working if the teammate who created it is deactivated or loses admin.

Every call is recorded with tool, success, error and IP. Every request is scoped to the key's organization on the server; organization ids are never read from the request.

The ten tools

Five read. Five write.

whoamireadSee your organization, plan, Daily Hours, hours used today, whether you're on a trial, and what this key is allowed to do.
list_brand_profilesreadSee your Brand Profiles, with colors and fonts, so every brief stays on brand.
list_projectsreadSee every request and where it stands, newest first, filtered by status.
get_projectreadRead the brief, the status, the latest 20 comments with names, and up to 100 delivered files.
get_delivery_linksreadGrab signed download links for delivered files. Each link expires in 15 minutes.
create_projectwriteBrief the team: title, type, brief, deliverables, sizes, Brand Profile, references and a needed-by date.
add_commentwriteAnswer the designer's question in the project thread. Everyone on the thread is notified.
request_revisionwriteSend precise feedback on delivered work and move the project to revision requested.
approve_projectwriteApprove the delivered work and mark it complete.
upload_filewriteAttach a file to a project: up to 10 MB directly, or a share link up to 2 GB. Not available on completed projects.

Write tools need an allow-changes key; a view-only key is never shown them in tools/list. Exact input schemas are returned by the standard MCP tools/list call.

The Monday.com sync is a separate connection set up in the Flocksy account, not an MCP tool, so you will not find it in tools/list.

Limits
Project title
200 characters
Brief
10,000 characters
Deliverables, sizes and formats
2,000 characters
Reference URLs
Up to 10, each up to 500 characters, http or https
Needed-by date
ISO 8601 date-time
list_projects page size
1 to 50, offset 0 to 10,000
Revision feedback
5,000 characters
get_project files
Up to 100 delivered files
get_delivery_links
Up to 50 files per call
upload_file
10 MB directly, or a share link up to 2 GB
get_project comments
Latest 20, with author names
Delivery links
Valid for 15 minutes
Free text
HTML is stripped before it is stored
Rate limit
60 requests per minute per key
Project status values
pendingactiveupdate_sentrevision_requestedcompleteddraft

request_revision sets a project to revision_requested. approve_project marks it completed. Filter list_projects by any of these.

Errors your agent will see

Plain messages, written for agents to relay.

"AI and API connections aren't included in your current plan."

The organization's plan does not include API access. API access is included on 4+ Daily Hour plans.

"This API key is read-only"

A view-only key called a write tool. Use an allow-changes key.

"Organization has no active subscription"

The organization has no active subscription or trial.

"Rate limit exceeded (60 requests/minute)"

This key sent more than 60 requests in a minute. Wait and retry.

"This project is completed, so files can't be added. Ask a production coordinator to reopen it if more work is needed."

upload_file was called on a completed project.

"Never put API keys in URLs. Use the Authorization header."

The key was sent in the URL. Send it as a Bearer token in the Authorization header.

If a plan excludes a project type, the agent is told which types are included. A trial that has used its hours is told to add a card before briefing more.

FAQ

Integration questions.

Where do I find the connection URL?+

Copy it from Settings, API Keys in your Flocksy account. It is never published on marketing pages.

How do I test a key?+

Call the whoami tool. It returns your organization, plan, Daily Hours, hours used today, whether you're on a trial, and the key's permissions without changing anything.

What are the exact tool parameters?+

Your client reads each tool's input schema from the server with the standard MCP tools/list call, so agents always see the current parameters and limits.

Which plans include the API?+

API access is included on 4+ Daily Hour plans and is checked on every request, so a plan change takes effect immediately. Other plans see the plan-access error above.

What happens if a plan excludes a project type?+

create_project only accepts project types the plan includes. If the agent asks for an excluded type, it is told which types are included.

Is the API synchronous?+

Calls return quickly, but the work is not instant. The server tells connecting assistants that work is asynchronous and takes hours, so agents should check list_projects or get_project on a schedule and report back. There are no outgoing webhooks.

AI accelerates. Humans finish.

Unused hours roll over. Cancel anytime. Backed by a 14-day money-back guarantee.