MCP Server & API

1. Get an API key

Create a key in the Developers area of your dashboard. Keys look like ad_live_… and are shown in full exactly once — store it safely, we only keep a hash. API access requires an eligible paid plan. Eligible first subscriptions to Indie offer an optional seven-day trial with a card. Studio starts paid, with no free trial. Eligible new trials bring your available AI token balance up to 50 once. You can also pay now for the full plan allowance after payment.

2a. MCP server (Claude, Cursor)

Install Node.js 22 or later, then add this configuration to your MCP client. On the first run npx installs the appdrift-mcp package from npm; no npm account is needed. Replace the API-key placeholder and restart the client.

{
  "mcpServers": {
    "appdrift": {
      "command": "npx",
      "args": ["-y", "appdrift-mcp"],
      "env": { "APPDRIFT_API_KEY": "ad_live_your_key_here" }
    }
  }
}

Inspect the 0.2.0 package and its SHA-256 checksum. The archive contains the complete MIT-licensed wrapper source.

Start with account_status, then list_apps. Both consume no AI tokens. Keep the key in private local configuration. Review paid calls and draft changes in your client. A timeout may happen after the API completed an action; check the balance and draft before retrying.

Tools exposed to the agent:

2b. REST API

Prefer to call it directly? Every endpoint takes your key as a bearer token; reads are GET, AI actions are POST with a JSON body. A machine-readable OpenAPI spec lives at /.well-known/openapi.json. Base URL:

https://appdrift-backend-1fabfc95f592.herokuapp.com

curl -H "Authorization: Bearer ad_live_your_key_here" \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/apps"

Endpoints

curl -H "Authorization: Bearer ad_live_..." \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/keyword-difficulty?keyword=meditation&platform=ios&country=us"

{
  "data": {
    "keyword": "meditation",
    "platform": "ios",
    "country": "us",
    "difficulty": 63,
    "popularity": 41,
    "source": "live"
  }
}

AI endpoints (charge tokens on success)

These consume plan tokens at the same prices as the dashboard, and only charge after successful API processing. A lost response or client timeout does not establish failure on the server: check the account before retrying.

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"keyword": "habit tracker"}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/apps/123/optimize"

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"platform": "ios", "app_name": "Drift", "app_description": "A minimalist habit tracker with streaks and reminders.", "fields": ["subtitle", "keywords"]}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/generate-metadata"

curl -X POST -H "Authorization: Bearer ad_live_..." -H "Content-Type: application/json" \
  -d '{"field": "subtitle", "text": "Build habits that stick", "target_languages": ["de-DE", "ja", "es-MX"]}' \
  "https://appdrift-backend-1fabfc95f592.herokuapp.com/v1/translate"

Rate limits

Per API key: 300 requests / 15 min overall, and 30 / 15 min on the AI endpoints. Standard RateLimit-* headers tell you where you stand.

3. Webhooks

Don't want to poll? AppDrift can push events to your own endpoints as they happen. Add up to 5 endpoints from the Developers area of your dashboard — available on every paid plan.

Events

Payload

Every delivery is a POST with a JSON envelope:

{
  "id": "evt_9f2c1a7d3b",
  "type": "keyword.rank_change",
  "created_at": "2026-08-03T09:00:00.000Z",
  "data": { /* event-specific payload */ }
}

Verifying signatures

Each endpoint gets a signing secret (whsec_…) shown exactly once at creation. Every delivery carries an X-AppDrift-Signature header in the form t=<unix>,v1=<hex>. Recompute the HMAC-SHA256 of `${t}.${rawBody}` with your secret, compare with a timing-safe compare, and reject anything whose timestamp is more than 5 minutes old:

const crypto = require("crypto");

// signatureHeader = req.headers["x-appdrift-signature"]  →  "t=1722672000,v1=abc123…"
// rawBody must be the exact raw request body string, not re-serialized JSON.
function verifyAppDriftSignature(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((kv) => kv.split("="))
  );
  const t = Number(parts.t);
  // Reject stale timestamps (replay protection): older than 5 minutes.
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const provided = parts.v1 || "";
  // Compare decoded bytes; malformed hex would otherwise truncate or throw.
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(provided, "hex");
  if (a.length !== b.length) return false;
  try {
    return crypto.timingSafeEqual(a, b);
  } catch {
    return false;
  }
}

Retries & auto-disable

• 4 attempts per event: immediate, then +1 minute, +10 minutes, and +60 minutes. A 2xx response counts as delivered; anything else (or a timeout) schedules the next retry.
• Auto-disable: after 20 consecutive failed deliveries the endpoint is disabled. Fix your receiver, then re-enable it from the Developers page — a “Send test” button lets you verify before real events flow again.
• Limits: up to 5 endpoints per account, each subscribed to any subset of the events above.

Notes

• Never store-direct. AI endpoints return proposals or write to your app's draft version inside AppDrift — nothing reaches the App Store or Play Store without your normal review → publish flow.
• Charge on success. AI endpoints check your token balance up front and only consume tokens when the call returns a result. Failed calls never charge.
• Tenant-scoped. A key only ever sees the account it was created in. Revoke a key any time from the Developers page.
• Cached where it helps. Keyword difficulty is served from a shared cache when fresh and computed live otherwise — the source field tells you which.