API overview

Base URL: https://chat.bootstrapware.co. Responses wrap payloads in { "data": ... }.

Publishable (browser / widget)

Use a publishable key (bsw_test_pub_ / bsw_live_pub_) as Authorization: Bearer. These routes are what the Hosted <Chat> widget calls.

• GET /api/v1/config/:appId: published app config
• GET/POST /api/v1/conversations: Hosted list / create
• GET /api/v1/conversations/:id plus members, leave, read, messages, search
• PATCH/POST /api/v1/messages/:id: edit / delete
• GET /api/v1/stream: SSE
• Attachment intent / content / file routes for Hosted uploads

Live config fetch requires BYO ($9.99) or Hosted ($19.99). Live Hosted message storage requires Hosted ($19.99). Test keys stay free.

Secret (server management)

Use a secret key (bsw_test_sec_ / bsw_live_sec_) as Bearer. Never put secret keys in the browser. These routes configure apps without the dashboard UI.

• GET /api/v1/apps: list apps in the key's workspace
• POST /api/v1/apps: create; body { "name": "In-app chat" }
• GET /api/v1/apps/:id: app, revisions, draft, and published config
• PATCH /api/v1/apps/:id: save draft name + config
• POST /api/v1/apps/:id: publish; body { "action": "publish" }
• GET /api/v1/usage: aggregate operational counts
• POST /api/v1/author-tokens: mint a short-lived host assertion

Create, draft, publish

# Create
curl -s -X POST https://chat.bootstrapware.co/api/v1/apps \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name":"In-app chat"}'

# Save draft (replace APP_ID)
curl -s -X PATCH https://chat.bootstrapware.co/api/v1/apps/APP_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"In-app chat",
    "config":{
      "allowDirect":true,
      "allowGroups":true,
      "allowAttachments":true,
      "allowMemberManage":true,
      "requireAuthorToken":false,
      "emptyState":"No conversations yet. Start one.",
      "allowedOrigins":["http://localhost:3000"]
    }
  }'

# Publish
curl -s -X POST https://chat.bootstrapware.co/api/v1/apps/APP_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish"}'

# Usage
curl -s https://chat.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Still dashboard-only

Minting or revoking API keys, webhook endpoints, app delete, branding, billing, and the Hosted inbox (including Team send) stay on the platform dashboard (cookie session). The secret management API and MCP do not cover those.

Hosted MCP

The same app-management capabilities are exposed as HTTP MCP at https://chat.bootstrapware.co/mcp. Prefer OAuth Connect: install the URL-only config from the Keys page, click Connect in Cursor, and approve. No secret is stored in mcp.json. A test secret pasted as a Bearer header still works as a fallback. Tools: list_apps, get_app, create_app, update_draft, publish_app, get_published_config, get_install_snippet, list_capabilities. Never send message bodies through MCP. See Agents for setup details.

Related: Configuration · Apps · API keys · AGENTS.md