Authentication - Snapto Docs

The REST API and the MCP server share one credential: a personal API token. There are two ways to create one:

Settings then Agents: one click per client. Mints a full-access agent key and shows the setup for Claude Code, Claude Desktop, Cursor, or any other MCP client. Use this to connect an agent.
Settings then API: name the token and pick its abilities. Use this for scripts and scoped integrations.

Tokens

Tokens are shown once, at creation. Store the value somewhere safe. You can revoke a token at any time from the same screen, which immediately cuts off both API and MCP access for it. The REST API takes the token in a header:

curl https://snapto.link/api/v1/profiles \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"

The MCP server takes it in the URL, because most MCP clients cannot send custom headers:

https://snapto.link/mcp/YOUR_TOKEN

Because the MCP token sits in the URL, treat the whole URL as a secret. Do not paste it into a shared config file, a screenshot, or a support ticket.

Abilities

Every token carries a set of abilities. Grant only what the integration needs. A reporting script does not need write access.

Ability	What it unlocks
`profiles:read`	Read profiles, and the runtime schema
`profiles:write`	Create and update profiles, publish and unpublish
`elements:read`	Read a profile’s links
`elements:write`	Create, update, delete, and reorder links, and set social links
`analytics:read`	Read visit and click analytics

A request that needs an ability the token lacks returns 403.

Plan requirement

API and MCP access requires an active paid subscription, Lite or above. Every plan starts with a 7 day free trial, and the trial includes full access. Without an active subscription, REST requests return 403 and MCP requests return a JSON-RPC error.

Rate limits

The REST API allows 60 requests per minute per user. Over the limit, you get 429. The MCP endpoint allows 60 requests per minute per IP address.

Errors

The REST API uses standard status codes.

Status	Meaning
`401`	Missing or invalid token, or the resource is not yours
`403`	The token lacks the required ability, or there is no active subscription
`404`	The resource does not exist
`422`	Validation failed. The response body lists the field errors
`429`	Rate limit exceeded

Ownership failures return 401 rather than 404. A profile that is not yours is treated as an authorisation failure, not a missing resource. Over MCP, the same conditions come back as tool errors with a readable message rather than HTTP status codes.

​Tokens

​Abilities

​Plan requirement

​Rate limits

​Errors

Tokens

Abilities

Plan requirement

Rate limits

Errors