Developers

Build on Stoaken

A REST API, an MCP server for AI agents, signed webhooks and a CLI. They share one set of permissions: every call runs as a person, inside their role on each Brand, and every change goes through review.

01 · HTTP

REST API

Read Brands, token sets, themes and releases, save token documents, propose releases and deprecations. Create an API key under Settings → API keys and send it as a Bearer token.

  • Pin the version with the Stoaken-Version: 2026-09-29 header.
  • Writes need an Idempotency-Key header, so a retried request never applies twice.
  • Lists are paged with a cursor: pass back next_cursor as returned.
  • Errors use the standard problem format (RFC 9457) with a stable type for each kind of problem.
  • Limits: 120 requests a minute and 60 writes an hour per credential, reported in RateLimit-* headers.
  • The full reference is an OpenAPI 3.1 document at /api/openapi.json.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
  -H "Stoaken-Version: 2026-09-29" \
  https://stoaken.com/api/brands
# Nothing is published: a person approves it.
curl -X POST -H "Authorization: Bearer $STOAKEN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: release-2026-10-06" \
  -d '{"version":"1.4.0"}' \
  https://stoaken.com/api/themes/THEME_ID/releases
REST API endpoints
MethodPath
GET/api/brands
GET/api/brands/:brandId
GET/api/brands/:brandId/token-sets
GET/api/brands/:brandId/themes
GET/api/token-sets/:tokenSetId
PUT/api/token-sets/:tokenSetId/document
GET/api/themes/:themeId
GET/api/themes/:themeId/tokens
GET/api/themes/:themeId/tokens/raw
GET/api/themes/:themeId/deprecations
POST/api/themes/:themeId/deprecations
GET/api/themes/:themeId/releases
GET/api/themes/:themeId/export
POST/api/themes/:themeId/releases
GET/api/releases/:releaseId
GET/api/releases/:releaseId/snapshot
GET/api/releases/:releaseId/export
POST/api/releases/:releaseId/submit

There is deliberately no endpoint to approve or publish. That happens in the Command Center, by a person.

Export tokens as code

Get a theme's live release as a file, ready to commit. The output has no timestamps, so a new export only shows up in a diff when the tokens changed. Pick a format with format:

  • cssCSS variablesA custom property for every token. Modes become attribute selectors, so one file covers them all.
  • json-dtcgJSON (W3C)Resolved tokens in the W3C 2025.10 format, for Style Dictionary v5 and other current tools. One mode per file.
  • json-sd4JSON (Style Dictionary v4)The same tokens with the older value format Style Dictionary v4 reads: hex colours, "16px", "200ms". One mode per file.
  • jsJavaScriptAn ES module exporting a nested object of CSS-ready values. One mode per file.
  • tsTypeScriptThe JavaScript module, typed with as const so values autocomplete. One mode per file.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
  "https://stoaken.com/api/themes/THEME_ID/export?format=css&prefix=acme" \
  -o tokens.css

CSS puts every mode in one file: the default under :root, the others as attribute selectors such as [data-color-scheme="dark"]. The other formats hold one mode per file; pass mode for a non-default one. To preview a release that's still waiting for review, export it by id: /api/releases/RELEASE_ID/export. Anything that can't be written faithfully (a gradient in CSS, for example) is left out and explained in the file's header, and counted in the Stoaken-Export-Warnings header.

02 · Model Context Protocol

AI agents (MCP)

Connect Claude or any client that speaks the Model Context Protocol to https://stoaken.com/mcp. Clients that support sign-in discovery connect with your Stoaken account; others can use an API key. The agent acts as you, with your role on each Brand.

  • list_brandsreadsThe Brands you can see, with your role on each.
  • get_theme_tokensreadsA theme's tokens as stored.
  • get_resolved_theme_tokensreadsTokens as a release would publish them, for any mode.
  • list_deprecated_tokensreadsWhat is deprecated, its replacement, and what still uses it.
  • list_releasesreadsA theme's releases, their status and what changed.
  • propose_token_changeproposesEdit a token set and submit it for review.
  • propose_token_deprecationproposesDeprecate a token, reviewed like any other change.

Proposals become releases waiting for review, and write tools have their own rate limit so a runaway agent can’t flood your reviewers.

03 · Events

Webhooks

Brand Admins add endpoints under Settings → Webhooks. Stoaken sends a small JSON event when a release changes state:

  • release.pending_approval
  • release.published
  • release.rejected
  • Each request is signed following the Standard Webhooks spec (webhook-id, webhook-timestamp, webhook-signature), so any of its libraries can verify it.
  • Failed deliveries are retried with increasing gaps for about a day.
  • Events carry ids and status, not tokens. Fetch the details from the REST API with your own key.

04 · Terminal

CLI

One command signs you in, lets you pick a Brand, and sets up the project you run it in for MCP and API access.

npx stoaken init