Connection options
- Use remote MCP with OAuth when the agent client supports hosted MCP servers.
- Use API keys for local scripts, CLI tools, and self-hosted agents that call the REST API directly.
- Treat API keys as secrets. Prefer read-only keys for lookup workflows.
Recommended workflow
- Check
GET /capabilitiesto see which safe workflows are available. - Ask which project the user wants to use unless the user already named one.
- List projects with
GET /projects. - Create a project only when no suitable project exists or the user asks for a
new one. For projects with spaces or timers, call
POST /projects/previewfirst, thenPOST /projectswithexpected_plan_hash. - Create spaces before assigning timers to them, unless they are nested in a project create request.
- Create timers with a clear label, ISO target date, and IANA timezone.
- Create a share link only when the user asks to share a timer.
Safety rules
- Use read-only API keys for answering questions.
- Use full-access API keys only for requested mutations.
- Add
Idempotency-Keyto everyPOST,PATCH, andDELETEyou may retry. - Never delete projects, timers, spaces, or shares without explicit user confirmation.
- For project or space deletion, call
DELETE ...?dry_run=truefirst and show the preview before applying the delete. - Do not invent timezones. If the user gives a city, map it to a real IANA timezone.
- Prefer
target_datevalues withZor an explicit offset. - When reading timers, answer countdown/deadline questions with
effective_target_date. For recurring timers,target_dateis the original schedule anchor. - When confirming timer changes, show
project_name, timer label, and date. Avoid raw project ids in user-facing text unless the user asks for ids. - Treat
rate_limitedas retryable after theretry-afterheader. - Treat
idempotency_conflictas a client bug. Generate a new key only after confirming the intended request body. - Use
error.code,error.retryable, anderror.errors[].pathfor recovery logic instead of branching on message text.
Field mapping
- Project names are short labels such as
Launch PlanorPersonal. - Spaces are categories inside a project, such as
Travel,Work, orSubscriptions. - Timers need
label,target_date, andtimezone. Timer responses also includeproject_nameandeffective_target_datefor user-facing answers. - Share links are static paths returned as
url_path, such as/share/abc123.