Your agency, wired to your AI

1. Sign in to the console as Owner or Admin, with two-factor authentication on.
2. Open Settings, then Developers, and click Create a key.
3. Give it a clear name. Tick only what your tool needs.
4. Type your two-factor code. The key shows only once: copy it right away.
5. Paste it in your tool's Authorization header: Bearer, then the key.

A key starts with vlr_live_ followed by 43 characters. After that, the console only shows its start, so you can spot it.

https://<domaine>/api/mcp

claude mcp add --transport http velora https://<domaine>/api/mcp \
  --header "Authorization: Bearer vlr_live_…"

{
  "mcpServers": {
    "velora": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://<domaine>/api/mcp",
        "--header", "Authorization:${VELORA_AUTH}"
      ],
      "env": { "VELORA_AUTH": "Bearer vlr_live_…" }
    }
  }
}

{
  "mcpServers": {
    "velora": {
      "url": "https://<domaine>/api/mcp",
      "headers": { "Authorization": "Bearer vlr_live_…" }
    }
  }
}

https://<domaine>/api/v1/openapi.json

The MCP tools

A key only sees the tools its rights allow. Read tools are marked read-only, so your AI can use them without asking you.

Every call carries the Authorization: Bearer vlr_live_… header. Calls from a browser are refused: call from a server.

curl https://<domaine>/api/v1/stats/summary?from=2026-10-01&to=2026-10-31 \
  -H "Authorization: Bearer vlr_live_…"

A list returns 50 items at most and a nextCursor. Pass it as cursor for the next page. It's null at the end.

On error, the answer gives a code and a message. The codes: unauthorized (401), insufficient_scope and browser_not_allowed (403), not_found (404), invalid_request (400), rate_limited and notification_cap_reached (429).

{ "error": { "code": "insufficient_scope", "message": "This key lacks the read:sales scope." } }

The full OpenAPI 3.1 schema

Reference

• 120 calls per minute per key, 600 per minute for the whole agency.
• 50 notifications a day for the agency, across all keys. The per-creator limit set in the console applies on top.
• Beyond that: a 429 response with a Retry-After header. Wait that many seconds.
• 20 active keys at most per agency.

• We only keep a fingerprint of your key. Even we cannot read it back.
• Each key is tied to your agency. The database itself refuses to show another agency's data.
• A key only has the rights you ticked. A read key changes nothing.
• If the admin who created it leaves the team or loses their role, the key stops working.
• Every send and every draft is recorded in the agency's log, with the key used.
• The API never returns e-mails, phone numbers, fan names, internal notes or files.
• Key lost or shared by mistake? Revoke it in the console, it takes effect at once.