MCP Server & API

1. Get an API key

Create a key in the Developers area of your dashboard. Keys look like ad_live_… and are shown in full exactly once — store it safely, we only keep a hash. API access is available on every paid plan (7-day free trial).

2a. MCP server (Claude, Cursor)

Add AppDrift to your MCP client config, drop in your key, and restart the client. Claude Desktop config lives in claude_desktop_config.json:

{
  "mcpServers": {
    "appdrift": {
      "command": "npx",
      "args": ["-y", "appdrift-mcp"],
      "env": { "APPDRIFT_API_KEY": "ad_live_your_key_here" }
    }
  }
}

Tools exposed to the agent:

2b. REST API

Prefer to call it directly? Every endpoint takes your key as a bearer token; reads are GET, AI actions are POST with a JSON body. A machine-readable OpenAPI spec lives at /.well-known/openapi.json. Base URL:

https://appdrift-backend-1fabfc95f592.herokuapp.com

curl -H "Authorization: Bearer ad_live_your_key_here" \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/apps"

Endpoints

curl -H "Authorization: Bearer ad_live_..." \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/keyword-difficulty?keyword=meditation&platform=ios&country=us"

{
  "data": {
    "keyword": "meditation",
    "platform": "ios",
    "country": "us",
    "difficulty": 63,
    "popularity": 41,
    "source": "live"
  }
}

AI endpoints (charge tokens on success)

These consume plan tokens at the same prices as the dashboard, and only charge when the call succeeds. A failed call never charges.

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"keyword": "habit tracker"}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/apps/123/optimize"

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"platform": "ios", "app_name": "Drift", "app_description": "A minimalist habit tracker with streaks and reminders.", "fields": ["subtitle", "keywords"]}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/generate-metadata"

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"field": "subtitle", "text": "Build habits that stick", "target_languages": ["de-DE", "ja", "es-MX"]}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/translate"

Rate limits

Per API key: 300 requests / 15 min overall, and 30 / 15 min on the AI endpoints. Standard RateLimit-* headers tell you where you stand.

3. Webhooks

Don't want to poll? AppDrift can push events to your own endpoints as they happen. Add up to 5 endpoints from the Developers area of your dashboard — available on every paid plan.

Events

Payload

Every delivery is a POST with a JSON envelope:

{
  "id": "evt_9f2c1a7d3b",
  "type": "keyword.rank_change",
  "created_at": "2026-08-03T09:00:00.000Z",
  "data": { /* event-specific payload */ }
}

Verifying signatures

Each endpoint gets a signing secret (whsec_…) shown exactly once at creation. Every delivery carries an X-AppDrift-Signature header in the form t=<unix>,v1=<hex>. Recompute the HMAC-SHA256 of `${t}.${rawBody}` with your secret, compare with a timing-safe compare, and reject anything whose timestamp is more than 5 minutes old:

const crypto = require("crypto");

// signatureHeader = req.headers["x-appdrift-signature"]  →  "t=1722672000,v1=abc123…"
// rawBody must be the exact raw request body string, not re-serialized JSON.
function verifyAppDriftSignature(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((kv) => kv.split("="))
  );
  const t = Number(parts.t);
  // Reject stale timestamps (replay protection): older than 5 minutes.
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const provided = parts.v1 || "";
  // Compare decoded bytes; malformed hex would otherwise truncate or throw.
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(provided, "hex");
  if (a.length !== b.length) return false;
  try {
    return crypto.timingSafeEqual(a, b);
  } catch {
    return false;
  }
}

Retries & auto-disable

• 4 attempts per event: immediate, then +1 minute, +10 minutes, and +60 minutes. A 2xx response counts as delivered; anything else (or a timeout) schedules the next retry.
• Auto-disable: after 20 consecutive failed deliveries the endpoint is disabled. Fix your receiver, then re-enable it from the Developers page — a “Send test” button lets you verify before real events flow again.
• Limits: up to 5 endpoints per account, each subscribed to any subset of the events above.

Notes

• Never store-direct. AI endpoints return proposals or write to your app's draft version inside AppDrift — nothing reaches the App Store or Play Store without your normal review → publish flow.
• Charge on success. AI endpoints check your token balance up front and only consume tokens when the call returns a result. Failed calls never charge.
• Tenant-scoped. A key only ever sees the account it was created in. Revoke a key any time from the Developers page.
• Cached where it helps. Keyword difficulty is served from a shared cache when fresh and computed live otherwise — the source field tells you which.