Jump to
Learn the basics
Build your first API in 10 minutes
What you will build
temperature value, ready for a script, Raspberry Pi, or another application to use. You do not need any hardware for this lesson.The request-response loop
1 · Request
Your browser, terminal, or device asks an endpoint to read or change data.
2 · Endpoint
The endpoint authenticates the request, validates the data, and performs the action.
3 · Response
The API returns a status code and usually a JSON body describing the result.
Five parts of an HTTP request
URL
Where to send it
Method
GET reads, POST creates, PATCH updates, DELETE removes
Headers
Context such as authentication and content type
Body
JSON—the text format of keys and values sent with a write
Status
The numeric result, such as 200 or 404
Before you start
curl. The commands use macOS, Linux, Git Bash, or WSL shell syntax. On Windows, Git Bash is the simplest way to run them exactly as written. PowerShell uses different environment-variable and line-continuation syntax.1. Create the app and collection
- 1Open Apps → New App. Use name
Weather Stationand slugweather-station. - 2Open the app and choose New Endpoint. Use name
Readings, slugreadings, and type Collection. - 3Open the endpoint and choose Add Field. Use label
Temperature, keytemperature, type Number, and enable Required.
Private by default
2. Create an app API key
API tutorial, enable both Read and Write, then copy the value immediately. The full key is shown once.export MEOW_APP_API_KEY="YOUR_APP_API_KEY"
export MEOW_USERNAME="YOUR_USERNAME"
export MEOW_API="https://meowmeowscratch.com/api"Replace both YOUR_APP_API_KEY andYOUR_USERNAME. Keep the quotation marks. Do not paste a real token into source code, chat, or a public repository.
3. Send your first POST request
POST creates data. This request sends one temperature record to the collection management endpoint.curl -i -X POST "$MEOW_API/apps/weather-station/endpoints/readings/records/" -H "Authorization: Bearer $MEOW_APP_API_KEY" -H "Content-Type: application/json" -d '{"data":{"temperature":22.5}}'HTTP/... 201 Created
{
"uuid": "…",
"data": {"temperature": 22.5},
"created_at": "…",
"updated_at": "…"
}201 Created means the API accepted the request and created a new resource. Your UUID identifies that record.
4. Read it back with GET
GET reads data without changing it. The consumer URL is the stable address a website, script, or device uses.curl -i "$MEOW_API/v1/$MEOW_USERNAME/weather-station/readings/" -H "Authorization: Bearer $MEOW_APP_API_KEY"HTTP/... 200 OK
{
"count": 1,
"fields": [
{"name": "temperature", "label": "Temperature", "field_type": "number"}
],
"records": [
{"uuid": "…", "data": {"temperature": 22.5}, "created_at": "…"}
]
}What the command means
curlThe command-line HTTP client sending the request.
-iShow the response status and headers as well as the JSON body.
-X POSTUse the POST method. GET is curl's default, so the read command does not need -X GET.
-HAdd a header. The Bearer header proves who you are; Content-Type says the body is JSON.
-dSend the following JSON as the request body.
5. Experiment
- Send a second POST with temperature set to 18.4, then GET the collection again.
- Add ?temperature__gte=20 to the GET URL and predict which record remains.
- Send temperature as "warm" and inspect the 400 validation response.
- Open Request Logs in the endpoint and find the GET request's status and response time.
You have built an API
Core product concepts
Collection
Many typed records
Sensor readings, events, form submissions, inventories
Static payload
One JSON document
Device state, configuration, flags, status documents
Proxy / integration
A guarded upstream request
Weather, games, or a third-party JSON service
Quick glossary
- API
- A defined way for programs to request data or actions from one another.
- Endpoint
- A URL that accepts a particular kind of API request.
- JSON
- A text format that represents data as objects, arrays, keys, and values.
- Schema
- The rules describing which fields exist and what type of value each accepts.
- Slug
- A short URL-safe name, such as weather-station.
- Token
- A secret credential sent with a request to prove identity and permission.
01 · Web app
Use the Meow Meow Scratch® web app
Create your first API
- 1
Create an app
Open Apps, choose New app, then set its display name, URL slug, and description. The app starts private.
- 2
Add an endpoint
Inside the app, choose Collection, Static Payload, or Proxy / Integration and give it a stable slug.
- 3
Configure its data
Add typed fields to a collection, edit the JSON payload for a static endpoint, or configure the upstream proxy.
- 4
Test the consumer URL
Open the endpoint page to copy its URL, inspect code snippets or QR code, and make a request.
Collection schemas
A field can be required, have a default, include help text, and carry type-specific options such as numeric bounds, select choices, rating maximums, or text placeholders. Records keep a UUID, timestamps, and the validated data object.
Endpoint behavior and operations
Chaos mode
Add a controlled delay or simulated error rate when testing clients.
Record expiry
Set a TTL so old collection records are automatically removed.
Transforms
Round or clamp numbers, normalize text case, or set missing defaults.
Webhooks
Deliver record and payload events to another HTTPS service.
Request logs
Inspect recent method, status, timing, client IP, and user-agent data.
Response encryption
Encrypt consumer responses and request plaintext with X-Encryption-Key.
Control panels
Remote configuration without building a backend
Put device settings in one static endpoint, bind dashboard controls to keys such as camera.thresholds.confidence, and let the Raspberry Pi poll that document with an app API key. A dashboard change updates the same JSON the device reads. Collection widgets are display-only and show values from the latest record; proxy endpoints do not support widgets.
Credentials
02 · REST API
Call the REST API directly
Content-Type: application/json with JSON request bodies. If HTTP is new to you, complete the beginner tutorial before using this section as a reference.Management API
Create and configure apps, endpoints, schemas, records, keys, webhooks, and control panels. Every request requires a Bearer token.
Consumer API
Read the stable URL used by websites, scripts, and devices. Private resources require a token; public resources allow anonymous reads.
Authentication
Authorization: Bearer YOUR_TOKENKeep the trailing slash
/api/apps/, not /api/apps, to avoid an HTTP redirect—especially for POST, PATCH, and DELETE requests.Choose the narrowest credential
App API key · one app
Recommended for Raspberry Pis, devices, and direct API integrations. The key can access only its app, and Read and Write scopes are enforced independently.
Platform token · all your apps
Recommended for the SDK, CLI, MCP, and account-wide resource automation. It can manage Meow resources across your account.
API credentials are accepted only by Meow resource routes, not authentication, profile, billing, chat, or CMS management. App keys also cannot create apps, manage credentials, or access account-wide control panels and provider configuration.
Use role-specific environment variables
MEOW_PLATFORM_API_KEY and app-scoped credentials in MEOW_APP_API_KEY. The SDK and tooling do not read the ambiguous legacy name MEOW_API_KEY.Set reusable shell values
export MEOW_API="https://meowmeowscratch.com/api"
export MEOW_APP_API_KEY="YOUR_APP_API_KEY"
export MEOW_USERNAME="YOUR_USERNAME"Consumer API
GET /api/v1/{username}/{app}/{endpoint}/
GET /api/v1/{username}/{app}/{endpoint}/{record_uuid}/
GET /api/v2/dashboards/{share_token}/
# Public reads omit the header; replace these slugs with a public app and endpoint
curl "$MEOW_API/v1/$MEOW_USERNAME/YOUR_PUBLIC_APP/YOUR_PUBLIC_ENDPOINT/"
# Supply a token for a private consumer endpoint
curl "$MEOW_API/v1/$MEOW_USERNAME/weather-station/readings/" \
-H "Authorization: Bearer $MEOW_APP_API_KEY"Filter, aggregate, and export collections
Filters
Use a field name for equality. Number and rating fields also accept __gt, __gte, __lt, and __lte.
Aggregates
Pass aggregate=avg,min,max,sum,count and a numeric field. Count does not require a field.
CSV
Pass format=csv to export up to 500 records. CSV export is unavailable for encrypted endpoints.
BASE="$MEOW_API/v1/$MEOW_USERNAME/weather-station/readings/"
curl "$BASE?temperature__gte=20&limit=50" -H "Authorization: Bearer $MEOW_APP_API_KEY"
curl "$BASE?aggregate=avg,max&field=temperature" -H "Authorization: Bearer $MEOW_APP_API_KEY"
curl "$BASE?format=csv" -H "Authorization: Bearer $MEOW_APP_API_KEY" -o readings.csvConsumer response shape
{
"count": 1,
"limit": 100,
"offset": 0,
"fields": [
{"name": "temperature", "label": "Temperature", "field_type": "number"}
],
"records": [
{"uuid": "…", "data": {"temperature": 22.5}, "created_at": "…"}
]
}Update and delete a record
204 No Content with no JSON body.export RECORD_UUID="UUID_FROM_THE_POST_RESPONSE"
curl -i -X PATCH "$MEOW_API/apps/weather-station/endpoints/readings/records/$RECORD_UUID/" -H "Authorization: Bearer $MEOW_APP_API_KEY" -H "Content-Type: application/json" -d '{"data":{"temperature":23.0}}'
curl -i -X DELETE "$MEOW_API/apps/weather-station/endpoints/readings/records/$RECORD_UUID/" -H "Authorization: Bearer $MEOW_APP_API_KEY"Successful status codes
A read or update succeeded and returned a body.
A POST created a new resource.
A delete succeeded and returned no body.
Management route reference
Apps and endpoints
/api/apps/List or create apps/api/apps/{app}/Read, update, or delete an app/api/apps/{app}/endpoints/List or create endpoints/api/apps/{app}/endpoints/{endpoint}/Manage one endpointCollection data
/api/apps/{app}/endpoints/{endpoint}/fields/List or add schema fields/api/apps/{app}/endpoints/{endpoint}/fields/{uuid}/Update or remove a field/api/apps/{app}/endpoints/{endpoint}/records/List or create records/api/apps/{app}/endpoints/{endpoint}/records/batch/Atomically create up to 100 records/api/apps/{app}/endpoints/{endpoint}/records/{uuid}/Manage one recordEndpoint configuration
/api/apps/{app}/endpoints/{endpoint}/payload/Read or replace a static payload/api/apps/{app}/endpoints/{endpoint}/proxy/Read or replace proxy configuration/api/apps/{app}/endpoints/{endpoint}/encryption/Inspect, enable, or disable encryption/api/apps/{app}/endpoints/{endpoint}/logs/Read the latest 50 request logs/api/apps/{app}/endpoints/{endpoint}/webhooks/List or create webhooks/api/apps/{app}/endpoints/{endpoint}/webhooks/{uuid}/Manage one webhook/api/apps/{app}/keys/List or create app-associated keys/api/apps/{app}/keys/{uuid}/Revoke an app-associated keyControl panels
/api/dashboards/List or create control panels/api/dashboards/{dashboard}/Manage a control panel/api/dashboards/{dashboard}/widgets/List widgets/api/dashboards/{dashboard}/widgets/{app}/{endpoint}/Create a widget with a slug-based binding/api/dashboards/{dashboard}/widgets/{uuid}/Update or remove a widget/api/dashboards/{dashboard}/state/Read configured widget values/api/dashboards/{dashboard}/widgets/{uuid}/value/Write through an interactive widgetCapacity and credentials
/api/limits/Read enforced plan limits and remaining capacity/api/auth/context/Inspect the non-secret credential contextCheck capacity before provisioning
GET /api/limits/. The response names the current plan, every enforced limit, and remaining global app and dashboard capacity. App, endpoint, and dashboard detail responses also include scoped capacity. Successful creation responses include X-Meow-Quota-* headers.| Limit | Free | Pro |
|---|---|---|
| Apps | 3 | 50 |
| Endpoints per app | 3 | 25 |
| Records per endpoint | 50 | 10,000 |
| Fields per endpoint | 10 | 50 |
| Dashboards | 3 | 15 |
| Widgets per dashboard | 12 | 50 |
| Webhooks per endpoint | 3 | 20 |
| App API keys | 2 | 20 |
| Maximum record payload | 64 KB | 512 KB |
| Maximum static payload | 256 KB | 1 MB |
Atomic batch ingestion
curl -X POST "$MEOW_API/apps/weather-station/endpoints/readings/records/batch/" \
-H "Authorization: Bearer $MEOW_APP_API_KEY" \
-H "Content-Type: application/json" \
-d '{"records":[
{"data":{"temperature":21.8}},
{"data":{"temperature":21.9}}
]}'Static payload envelope and nested key paths
data and read-only updated_at. Dashboard bindings use dot notation. Missing objects are created for static writes, but a non-object intermediate value is rejected.{
"data": {
"camera": {
"thresholds": {"confidence": 0.65}
}
},
"updated_at": "2026-07-25T10:00:00Z"
}Schema changes after data exists
Encryption and errors
Encrypted consumer responses
encrypted, algorithm, fingerprint, and data. Send the one-time key as X-Encryption-Key to request a plaintext response. A wrong key returns 403.Invalid input
Bad or missing auth
Not permitted
Resource not found
Rate limited
Writes are strict
/api/* are JSON.03 · Python SDK & CLI
Python SDK and CLI
meow-sdk wraps the REST API and installs the meow CLI. It supports Python 3.8 and newer and uses the same resource names as the web app.Recommended credential: platform token
Installation details, complete examples, releases, and package metadata.
Read the meow-sdk docs on PyPI ↗Install and configure
pip install meow-sdk
export MEOW_PLATFORM_API_KEY="YOUR_PLATFORM_TOKEN"
export MEOW_APP_API_KEY="YOUR_APP_API_KEY"
export MEOW_USERNAME="YOUR_USERNAME"
# Optional for a self-hosted or local backend:
export MEOW_URL="https://meowmeowscratch.com"import os
from meow_sdk import Meow
api = Meow(
base_url=os.getenv("MEOW_URL", "https://meowmeowscratch.com"),
username=os.getenv("MEOW_USERNAME"),
api_key=os.environ["MEOW_PLATFORM_API_KEY"],
timeout=30,
)
# Check enforced capacity before provisioning a schema or dashboard.
print(api.limits())Collection workflow
is_public=True to keep both resources private.from meow_sdk import Meow
import os
api = Meow(api_key=os.environ["MEOW_PLATFORM_API_KEY"])
api.create_app("Weather Station", "weather-station", is_public=True)
api.create_endpoint(
"weather-station",
"Readings",
"readings",
endpoint_type="collection",
is_public=True,
)
api.create_field(
"weather-station",
"readings",
"temperature",
"Temperature",
"number",
required=True,
options={"min": -50, "max": 80, "step": 0.1},
)
created = api.send(
"weather-station",
"readings",
{"temperature": 22.5},
)
api.send_many(
"weather-station",
"readings",
[{"temperature": 22.6}, {"temperature": 22.7}],
)
page = api.records("weather-station", "readings", limit=25)
api.update(
"weather-station",
"readings",
created["uuid"],
{"temperature": 23.0},
)
print(page["results"])Static settings and a remote control
{}. Use get_payload_state() when the update timestamp matters. A widget binding names the app and endpoint once; later value changes target only the widget UUID.api.create_endpoint(
"weather-station", "Device Settings", "settings", endpoint_type="static"
)
api.set_payload("weather-station", "settings", {
"camera": {"thresholds": {"confidence": 0.65}}
})
settings = api.get_payload("weather-station", "settings")
api.create_dashboard("Camera Controls", "camera-controls")
widget = api.create_dashboard_widget(
"camera-controls",
"weather-station",
"settings",
"camera.thresholds.confidence",
"slider",
"Tracking confidence",
config={"min": 0, "max": 1, "step": 0.05},
)
api.set_dashboard_widget_value("camera-controls", widget["uuid"], 0.7)Public reads do not need a token
from meow_sdk import Meow
public = Meow(username="YOUR_USERNAME")
readings = public.get(
"weather-station",
"readings",
temperature__gte=20,
limit=25,
)
stats = public.aggregate(
"weather-station",
"readings",
["avg", "max"],
field="temperature",
)
csv_text = public.export_csv("weather-station", "readings")Client method reference
Public reads
- get(app, endpoint, **filters)
- get_record(app, endpoint, record_id)
- aggregate(app, endpoint, aggregates, field=None)
- export_csv(app, endpoint, **filters)
- public_dashboard(share_token)
Apps and endpoints
- apps() / get_app(slug)
- create_app(...) / update_app(...) / delete_app(...)
- endpoints(app) / get_endpoint(app, endpoint)
- create_endpoint(...) / update_endpoint(...) / delete_endpoint(...)
Collection data
- records(app, endpoint, limit=25, offset=0)
- all_records(app, endpoint)
- send(app, endpoint, data)
- send_many(app, endpoint, records)
- update(app, endpoint, record_id, data)
- delete_record(app, endpoint, record_id)
- fields(...) / create_field(...) / update_field(...) / delete_field(...)
- field_types()
Payloads and integrations
- get_payload(...) / get_payload_state(...) / set_payload(...)
- get_proxy(...) / set_proxy(...)
- webhooks(...) / get_webhook(...)
- create_webhook(...) / update_webhook(...) / delete_webhook(...)
- get_encryption(...) / enable_encryption(...) / disable_encryption(...)
- request_logs(app, endpoint)
Control panels
- dashboards() / get_dashboard(slug)
- create_dashboard(...) / update_dashboard(...) / delete_dashboard(...)
- dashboard_widgets(dashboard)
- create_dashboard_widget(...) / update_dashboard_widget(...) / delete_dashboard_widget(...)
- dashboard_state(dashboard)
- set_dashboard_widget_value(dashboard, widget_uuid, value)
Keys and capacity
- app_keys(app) / create_app_key(app) / delete_app_key(app, uuid)
- platform_tokens() / create_platform_token(name) / revoke_platform_token(uuid)
- limits() / auth_context()
Limits are token-safe; billing is session-only
limits() for provisioning and manage checkout or the customer portal in the web app. billing_status() is deprecated.Exceptions
MeowError and include the HTTP status and response when available. Structured failures also expose code, field, hint, and details without string matching.from meow_sdk.exceptions import (
AuthError,
MeowError,
NotFoundError,
RateLimitError,
ValidationError,
)
try:
api.send("weather-station", "readings", {"temperature": "hot"})
except ValidationError as exc: # HTTP 400
print(exc.code, exc.field, exc.hint)
except AuthError: # HTTP 401 or 403
print("Check the token and resource access")
except NotFoundError: # HTTP 404
print("Check the app and endpoint slugs")
except RateLimitError: # HTTP 429
print("Retry with backoff")
except MeowError as exc:
print(f"Request failed: {exc}")CLI quick reference
MEOW_PLATFORM_API_KEY. Data-plane commands read MEOW_APP_API_KEY. The CLI also reads MEOW_USERNAME and optional MEOW_URL. Commands return JSON.meow apps
meow endpoints weather-station
meow fields weather-station readings
meow limits
meow send weather-station readings temperature=22.5
meow send-batch weather-station readings @records.json
meow records weather-station readings --limit 25
meow get weather-station readings temperature__gte=20
meow payload-get weather-station status
meow payload-get weather-station status --metadata
meow logs weather-station readings
meow webhooks weather-station readings
meow dashboards
meow widget-create camera-controls weather-station settings \
camera.thresholds.confidence slider "Tracking confidence" \
--config '{"min":0,"max":1,"step":0.05}'
meow widget-set camera-controls WIDGET_UUID 0.7
meow --helpPackage documentation
The PyPI project page includes installation, quickstarts, Raspberry Pi examples, CLI usage, error handling, and the method map.
04 · MCP server
Connect an AI agent with MCP
Transport
Streamable HTTP · stateless
Remote endpoint
https://meowmeowscratch.com/mcp/Authentication
export MEOW_PLATFORM_API_KEY="YOUR_PLATFORM_TOKEN"Install Meow Agent Tools
use-meow skill and the hosted MCP connection for Codex and Claude Code. The skill teaches the agent how to choose between the web app, REST API, SDK, CLI, and MCP; design endpoints; work safely with credentials; and build Raspberry Pi or IoT projects.meowmeowscratch/meow-agent-tools
One shared skill with native plugin and MCP packaging for both supported agent clients. Review the source and release notes before installing updates.
Codex
codex plugin marketplace add meowmeowscratch/meow-agent-tools
codex plugin add meow-meow-scratch@meow-agent-toolsStart a new Codex thread after installation. Ask for a Meow Meow Scratch® task naturally, or inspect /mcp if the tools are not available.
Claude Code
claude plugin marketplace add meowmeowscratch/meow-agent-tools
claude plugin install meow-meow-scratch@meow-agent-toolsStart a new session or run /reload-plugins. Claude Code can select the skill automatically, or you can invoke/meow-meow-scratch:use-meow directly.
The plugin does not contain your token
MEOW_PLATFORM_API_KEY from the environment of the process that launches the agent. Keep the token out of repositories, project configuration, prompts, and logs. Agent Tools supports Codex and Claude Code; it is not a Claude.ai or Claude Desktop connector.Configure Codex manually
codex mcp add meow \
--url https://meowmeowscratch.com/mcp/ \
--bearer-token-env-var MEOW_PLATFORM_API_KEY
codex mcp listThe equivalent user configuration is:
[mcp_servers.meow]
url = "https://meowmeowscratch.com/mcp/"
bearer_token_env_var = "MEOW_PLATFORM_API_KEY"Restart Codex or the IDE extension after editing the file. Run/mcp to verify the connection. For a project-specific setup, put the same table in .codex/config.toml; Codex loads it only for trusted projects. See the official Codex MCP guide ↗.
Configure Claude Code manually
.mcp.json. Claude Code expands MEOW_PLATFORM_API_KEY from the local environment, so the configuration can be committed safely.{
"mcpServers": {
"meow": {
"type": "http",
"url": "https://meowmeowscratch.com/mcp/",
"headers": {
"Authorization": "Bearer ${MEOW_PLATFORM_API_KEY}"
}
}
}
}export MEOW_PLATFORM_API_KEY="YOUR_PLATFORM_TOKEN"
claude mcp list
claudeThe type field is required and may behttp or streamable-http. Approve the server when Claude Code first opens the project, then run /mcp to verify the connection. See the official Claude Code MCP guide ↗.
Claude web and Desktop connectors
Connection checks
/mcp/ to avoid a redirect. If tools are unavailable, verify MEOW_PLATFORM_API_KEY, restart the client, and inspect /mcp. Once tools load, call connection_status to confirm that the MCP Authorization header contains a platform token and to inspect its scopes without exposing the token.Available tool families
Structure
Discover, create, update, and delete apps and endpoints.
Collections
Define fields and create, batch, update, or delete validated records.
Endpoint behavior
Configure static payloads, proxies, encryption, webhooks, and inspect request logs.
Control panels
Create slug-bound widgets, read only configured state, and write through widget UUIDs.
Consumer reads
Read public endpoints and records, aggregate values, export CSV, and open shared dashboards.
Discovery
Check the connection, enforced limits, field types, and resources before making changes.
Recommended tool workflow
- 01Call connection_status, then get_limits before provisioning.
- 02List apps and endpoints before making changes.
- 03Inspect the endpoint and field schema before writing data.
- 04Require confirmation before destructive operations.
- 05Call the narrowest applicable tool and read the resource back to verify the result.
- 06Return the consumer URL and relevant resource identifiers.
Limits and safety
60 tool calls per minute
Destructive calls need an approval policy
Account routes stay out of scope
05 · Open source
Example projects
Start without hardware
Classroom quiz
Learn shared state, writes, reads, and result tallying before connecting a device.
First Raspberry Pi project
CPU monitor
Publish useful device telemetry without purchasing or wiring an external sensor.
GitHub
meowmeowscratch
SDK source, Raspberry Pi projects, classroom examples, issues, and releases.
meow-sdk
The official Python client and CLI for apps, endpoints, records, and control panels.
meow-agent-tools
Install the shared use-meow skill and hosted MCP configuration in Codex or Claude Code.
pi-thermal-camera
Build an AMG8833 thermal camera with an 8×8 heat map and stream frames to your app.
pi-reaction-timer
Measure button reaction times with GPIO, then publish results and a persistent leaderboard.
pi-xmas-lights
Connect Raspberry Pi Christmas lights to an API-backed remote control project.
pi-weather-station
Collect weather sensor readings on a Pi and make them available through your app.
pi-plant-monitor
Publish plant and soil readings from a Raspberry Pi monitoring project.
pi-motion-logger
Record motion sensor events and inspect the resulting history through the API.
pi-led-dashboard
Turn live endpoint values into a physical Raspberry Pi LED dashboard.
pi-door-monitor
Track door state changes with a Raspberry Pi and an app endpoint.
pi-cpu-monitor
Report CPU temperature, load, memory, and disk usage from a headless Raspberry Pi.
classroom-quiz
Run a live classroom quiz with a shared question, collected answers, and result tallying.
Ship safely
Production checklist
- Keep platform tokens and app API keys in a secret manager or environment variable and rotate them after suspected exposure.
- Prefer an app API key with the minimum Read and Write scopes for each device or single-app integration.
- Use public visibility only for data that is genuinely safe for anonymous internet access.
- Preserve trailing slashes on REST and MCP URLs to avoid redirects during writes and protocol negotiation.
- Apply timeouts and exponential backoff for 429 and transient 5xx responses; do not retry validation failures.
- Store API and encryption keys when they are created; full values are shown once.
- Treat shared control-panel links as bearer secrets and expire or disable sharing when it is no longer needed.
- Verify proxy targets and transformations with non-sensitive data before enabling a public integration.
- Require explicit human confirmation before an agent deletes apps, endpoints, records, keys, or dashboards.