API overview

Base URL: https://onboard.bootstrapware.co. Responses wrap payloads in { "data": ... }.

Publishable (browser / widget)

Use a publishable key (bsw_test_pub_ / bsw_live_pub_) as Authorization: Bearer. These routes are what the Hosted <Onboard> widget calls.

  • GET /api/v1/config/:flowId: published flow config (items, eligibility, origins, toggles)
  • Hosted progress: get / complete / skip / dismiss / snooze / resume / reset (live needs authorToken)
  • POST /api/v1/outcomes: integration-reported summaries (Hosted)

Live config fetch requires BYO ($9.99) or Hosted ($19.99). Live Hosted progress writes require Hosted ($19.99) plus authorToken from your BFF. Test keys stay free.

Secret (server management)

Use a secret key (bsw_test_sec_ / bsw_live_sec_) as Bearer. Never put secret keys in the browser. These routes configure flows without the dashboard UI.

  • GET /api/v1/flows: list flows in the key's workspace
  • POST /api/v1/flows: create; body { "name": "SaaS first-run" }
  • GET /api/v1/flows/:id: flow, revisions, draft, and published config
  • PATCH /api/v1/flows/:id: save draft name + config
  • POST /api/v1/flows/:id: publish; body { "action": "publish" }
  • GET /api/v1/usage: aggregate operational session counts
  • POST /api/v1/author-tokens: mint a short-lived host assertion

Create, draft, publish

# Create
curl -s -X POST https://onboard.bootstrapware.co/api/v1/flows \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name":"SaaS first-run"}'

# Save draft (replace FLOW_ID)
curl -s -X PATCH https://onboard.bootstrapware.co/api/v1/flows/FLOW_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"SaaS first-run",
    "config":{
      "requireAuthorToken":true,
      "emptyState":"You are all set.",
      "allowedOrigins":["http://localhost:3000"],
      "snoozeDays":[1,7]
    }
  }'

# Publish
curl -s -X POST https://onboard.bootstrapware.co/api/v1/flows/FLOW_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish"}'

# Author token (BFF only)
curl -s -X POST https://onboard.bootstrapware.co/api/v1/author-tokens \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"authorId":"user_123","flowId":"flw_...","workspaceKey":"ws_acme","expiresInSec":3600}'

# Usage
curl -s https://onboard.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Still dashboard-only

Minting or revoking API keys, webhook endpoints, flow delete, branding, billing, Hosted progress export, and summaries preview stay on the platform dashboard (cookie session). The secret management API and MCP do not cover those.

Hosted MCP

The same flow-management capabilities are exposed as HTTP MCP at https://onboard.bootstrapware.co/mcp. Prefer OAuth Connect: install the URL-only config from the Keys page, click Connect in Cursor, and approve. No secret is stored in mcp.json. A test secret pasted as a Bearer header still works as a fallback. Tools: list_flows, get_flow, create_flow, update_draft, publish_flow, get_published_config, get_install_snippet, list_revisions, restore_revision, list_capabilities. Never send host context, flags, or progress payloads through MCP. See Agents for setup details.

Related: Configuration · API keys · Identity · AGENTS.md