Developers
Build on Stoaken
A REST API, an MCP server for AI agents, signed webhooks and a CLI. They share one set of permissions: every call runs as a person, inside their role on each Brand, and every change goes through review.
01 · HTTP
REST API
Read Brands, token sets, themes and releases, save token documents, propose releases and deprecations. Create an API key under Settings → API keys and send it as a Bearer token.
- Pin the version with the
Stoaken-Version: 2026-09-29header. - Writes need an
Idempotency-Keyheader, so a retried request never applies twice. - Lists are paged with a cursor: pass back
next_cursoras returned. - Errors use the standard problem format (RFC 9457) with a stable type for each kind of problem.
- Limits: 120 requests a minute and 60 writes an hour per credential, reported in
RateLimit-*headers. - The full reference is an OpenAPI 3.1 document at
/api/openapi.json.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
-H "Stoaken-Version: 2026-09-29" \
https://stoaken.com/api/brands# Nothing is published: a person approves it.
curl -X POST -H "Authorization: Bearer $STOAKEN_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: release-2026-10-06" \
-d '{"version":"1.4.0"}' \
https://stoaken.com/api/themes/THEME_ID/releases| Method | Path |
|---|---|
| GET | /api/brands |
| GET | /api/brands/:brandId |
| GET | /api/brands/:brandId/token-sets |
| GET | /api/brands/:brandId/themes |
| GET | /api/token-sets/:tokenSetId |
| PUT | /api/token-sets/:tokenSetId/document |
| GET | /api/themes/:themeId |
| GET | /api/themes/:themeId/tokens |
| GET | /api/themes/:themeId/tokens/raw |
| GET | /api/themes/:themeId/deprecations |
| POST | /api/themes/:themeId/deprecations |
| GET | /api/themes/:themeId/releases |
| GET | /api/themes/:themeId/export |
| POST | /api/themes/:themeId/releases |
| GET | /api/releases/:releaseId |
| GET | /api/releases/:releaseId/snapshot |
| GET | /api/releases/:releaseId/export |
| POST | /api/releases/:releaseId/submit |
There is deliberately no endpoint to approve or publish. That happens in the Command Center, by a person.
Export tokens as code
Get a theme's live release as a file, ready to commit. The output has no timestamps, so a new export only shows up in a diff when the tokens changed. Pick a format with format:
cssCSS variablesA custom property for every token. Modes become attribute selectors, so one file covers them all.json-dtcgJSON (W3C)Resolved tokens in the W3C 2025.10 format, for Style Dictionary v5 and other current tools. One mode per file.json-sd4JSON (Style Dictionary v4)The same tokens with the older value format Style Dictionary v4 reads: hex colours, "16px", "200ms". One mode per file.jsJavaScriptAn ES module exporting a nested object of CSS-ready values. One mode per file.tsTypeScriptThe JavaScript module, typed with as const so values autocomplete. One mode per file.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
"https://stoaken.com/api/themes/THEME_ID/export?format=css&prefix=acme" \
-o tokens.cssCSS puts every mode in one file: the default under :root, the others as attribute selectors such as [data-color-scheme="dark"]. The other formats hold one mode per file; pass mode for a non-default one. To preview a release that's still waiting for review, export it by id: /api/releases/RELEASE_ID/export. Anything that can't be written faithfully (a gradient in CSS, for example) is left out and explained in the file's header, and counted in the Stoaken-Export-Warnings header.
02 · Model Context Protocol
AI agents (MCP)
Connect Claude or any client that speaks the Model Context Protocol to https://stoaken.com/mcp. Clients that support sign-in discovery connect with your Stoaken account; others can use an API key. The agent acts as you, with your role on each Brand.
list_brandsreadsThe Brands you can see, with your role on each.get_theme_tokensreadsA theme's tokens as stored.get_resolved_theme_tokensreadsTokens as a release would publish them, for any mode.list_deprecated_tokensreadsWhat is deprecated, its replacement, and what still uses it.list_releasesreadsA theme's releases, their status and what changed.propose_token_changeproposesEdit a token set and submit it for review.propose_token_deprecationproposesDeprecate a token, reviewed like any other change.
Proposals become releases waiting for review, and write tools have their own rate limit so a runaway agent can’t flood your reviewers.
03 · Events
Webhooks
Brand Admins add endpoints under Settings → Webhooks. Stoaken sends a small JSON event when a release changes state:
release.pending_approvalrelease.publishedrelease.rejected
- Each request is signed following the Standard Webhooks spec (
webhook-id,webhook-timestamp,webhook-signature), so any of its libraries can verify it. - Failed deliveries are retried with increasing gaps for about a day.
- Events carry ids and status, not tokens. Fetch the details from the REST API with your own key.
04 · Terminal
CLI
One command signs you in, lets you pick a Brand, and sets up the project you run it in for MCP and API access.
npx stoaken init