Developers: API, webhooks and MCP

Settings → Developers is where API keys, outbound webhooks, the MCP connection and request logs live.

API keys

Create a key with a name, a scope (read-only or read + write) and a per-minute limit. The full key is shown once and starts with wx_live_. Wexlyn stores only a peppered SHA-256 hash, so keep your copy safe. Revoke any time; the last-used time is shown per key. Keys belong to the account that was active when you created them.

REST API v1

Base URL https://app.wexlyn.ai/api/v1, bearer authentication, JSON in and out. The OpenAPI 3.1 description is served at /api/v1/openapi.json.

# Who am I
curl https://app.wexlyn.ai/api/v1/me -H "Authorization: Bearer wx_live_..."

# Search leads
curl "https://app.wexlyn.ai/api/v1/leads?search=jane" -H "Authorization: Bearer wx_live_..."

# Record a sale (write key)
curl -X POST https://app.wexlyn.ai/api/v1/sales \
  -H "Authorization: Bearer wx_live_..." -H "Content-Type: application/json" \
  -d '{"email":"jane@example.com","amount":997,"currency":"USD","order_id":"A1001","product":"Coaching program"}'

# Performance report, Scientific model, last 30 days, grouped by campaign
curl "https://app.wexlyn.ai/api/v1/reports/performance?model=scientific&groupBy=campaign" \
  -H "Authorization: Bearer wx_live_..."

Endpoint	Scope	What it does
GET /me	read	Account and key scopes
GET /leads, GET /leads/{id}	read	Search leads; one lead with sales, calls and journey
POST /leads, POST /leads/{id}/stage	write	Create/identify a lead; move it to a stage
GET /sales, POST /sales	read / write	List sales; record a sale (deduped by order_id)
GET /calls, POST /calls	read / write	List calls; record a call with outcome and closer
GET /sources, POST /sources	read / write	List sources; create a manual source with its ?sl= link
GET /reports/performance	read	The Performance report with every setting the UI has
GET /reports/ads	read	Ad-level metrics keyed by platform ids (what the Chrome extension reads)

Errors come back as { "error": { "code", "message" } } with 401 (bad key), 403 (missing scope), 422 (validation), 429 (rate limit). Re-sending a sale with the same order_id updates instead of duplicating.

Webhooks

Register an https endpoint and pick events: lead.created, lead.stage_changed, sale.created, call.created, subscription.updated. Every delivery is a JSON POST:

{ "id": "evt_…", "event": "sale.created", "created_at": "2026-10-08T21:30:00Z",
  "data": { "order_id": "…", "lead_id": "…", "amount": 997, "currency": "USD", "products": ["Coaching program"] } }

Headers: Wexlyn-Event, Wexlyn-Delivery and Wexlyn-Signature: t=<unix>,v1=<hex> where v1 = HMAC_SHA256(secret, t + "." + body). Reject anything older than five minutes or with a bad signature. Non-2xx answers retry after 1, 5, 30, 120 and 720 minutes; the delivery log shows every attempt and lets you retry or send a test ping.

MCP server

Claude Code, Claude Desktop and claude.ai can talk to your account through https://app.wexlyn.ai/api/mcp (Streamable HTTP). Authenticate with an API key in the Authorization header:

claude mcp add --transport http wexlyn https://app.wexlyn.ai/api/mcp \
  --header "Authorization: Bearer wx_live_..."

Tools: get_account, list_sources, get_performance_report, search_leads, get_lead, list_sales, list_calls with any key, plus create_lead, create_sale, create_call, set_lead_stage with a write key. Every call shows under Request logs with source MCP.

Zapier, Make and n8n

For no-code tools use the Zapier / Make / Webhook integration under Settings → Integrations: it gives you a private URL that accepts the same lead, sale, call and stage payloads without an API key.