Machine access

Prood has one API for people, services and AI agents:

OpenAPI: GET https://api.prood.com/v1/openapi.json
Reference: Commerce API
TypeScript client: @prood/api-client, available from the source repo for now
MCP: POST https://api.prood.com/mcp
Agent Auth: GET https://api.prood.com/.well-known/agent-configuration
CLI: prood, available from the source repo for now

API keys

Create keys in the dashboard, under Connections, then API keys. Each key belongs to one organization and is shown once.

Scope	What it does
Storefront	Browse products, fill a cart and place an order. Payment runs on hosted checkout, started from the store
Admin	Reads and changes catalog, inventory, orders and store settings, and reads customers. Payment accounts, domains, team and keys stay in the dashboard. Starts on Grow.

Keys start with pk, followed straight away by random letters and numbers, with no underscore: pkAbC123....

Free API keys reach the public storefront API: catalog, carts and placing orders. Reading your orders and customers by API, and all admin writes, start on Grow.

Use the key with REST, MCP or the CLI:

curl -H "x-api-key: $PROOD_API_KEY" https://api.prood.com/v1/me

Errors come back as JSON: { "code": "UNAUTHORIZED", "message": "Invalid API key. It may be mistyped, or it may have expired. Create a new one in your dashboard, under API keys." }.

With Agent Auth, an AI agent starts with nothing until you approve it for your store. After that it keeps the public catalog, and anything else needs your approval. You see every capability the agent asks for and approve or deny the request as a whole. Approved access ends after an hour idle, or 24 hours at most. Then the agent asks again.

An API key isn't Agent Auth: anything holding an admin key can do what the key allows, without asking.

Agent Auth is coming with Grow.

Agents discover the provider configuration:

curl https://api.prood.com/.well-known/agent-configuration

Every OpenAPI operationId becomes an Agent Auth capability. Direct REST calls use a bearer token:

curl -H "Authorization: Bearer eyJ..." https://api.prood.com/v1/products

See Agent Auth for the full flow.

MCP

MCP tools use the same names as OpenAPI operation IDs. Free keys reach the 21 storefront tools.

json

{
  "mcpServers": {
    "prood-commerce": {
      "url": "https://api.prood.com/mcp",
      "headers": {
        "x-api-key": "pkAbC123..."
      }
    }
  }
}

TypeScript client

import { createCommerceApiClient, unwrap } from '@prood/api-client'

const api = createCommerceApiClient({
  baseUrl: 'https://api.prood.com/v1',
  apiKey: process.env.PROOD_API_KEY,
})

const caller = await unwrap(api.GET('/me'))

CLI

zsh

prood auth whoami --api-url https://api.prood.com/v1 --api-key "$PROOD_API_KEY" --json
prood products list --api-url https://api.prood.com/v1 --api-key "$PROOD_API_KEY" --json
prood mcp config --api-url https://api.prood.com/v1 --api-key "$PROOD_API_KEY"
prood openapi sync --check

API keysCopy Anchor Link

Agent AuthCopy Anchor Link

MCPCopy Anchor Link

TypeScript clientCopy Anchor Link

CLICopy Anchor Link

API keys

Agent Auth

MCP

TypeScript client

CLI