Getting started

Call it without a token

Paste the block on the right into a terminal. It answers immediately: the public catalogue at https://mcp.inleed.com/api/public/v1 serves product and domain pricing to anyone, with no account and no credential. Everything that touches an account needs a token.

Get a token

Tokens are minted in the client area and nowhere else: Menu → API access → Create token. Pick Read-only to start — it can read every part of the account and change nothing. Authentication covers the presets, expiry, IP allowlist and what each scope unlocks.

The secret is shown once, starts inl_live_, and is what every example below expects in $INLEED_TOKEN.

Two doors, one token

The same 401 endpoints stand behind two front doors. Use either, or both.

REST

Plain HTTP, a bearer header, JSON in and out. No SDK, no session, no signing step. Start with GET /me — the block in the rail.

MCP

The same actions as 206 tools for Claude, ChatGPT, Cursor and anything else that speaks MCP. One command below and the assistant has your hosting account.

Connect an assistant

claude mcp add --transport http inleed https://mcp.inleed.com/mcp \
  --header "Authorization: Bearer $INLEED_TOKEN"

{
  "mcpServers": {
    "inleed": {
      "type": "http",
      "url": "https://mcp.inleed.com/mcp",
      "headers": { "Authorization": "Bearer inl_live_…" }
    }
  }
}

Check what you hold

GET /me is the call every integration should make first — the same answer the whoami tool gives. It reports the scopes the token actually carries and the live rate-limit budget (300 requests per 5-minute window), so a missing scope surfaces here instead of as a 403 in production.

userId and tokenUserId are always the same account: a token can only ever reach the account it was minted for, and there is no cross-tenant credential. deniedTools lists tools blocked on this token regardless of scope.

Act on something you own

Ownership is checked against your account on every call, and a name that exists elsewhere on the platform is a miss for you, not a hit. If a user hands you a domain, resolve it before you write to it: you get back the service id, the hosting account and the node — or a clear 403 domain_not_owned with a recovery hint, instead of a confusing failure three calls later.

Authentication — scopes, presets, expiry, revocation.
The reference — all 401 endpoints and 206 tools, grouped.

# Everything on the account, with the ids the rest of the API expects. curl -s https://mcp.inleed.com/api/v1/services -H "Authorization: Bearer $INLEED_TOKEN" # Any identifier a human would type → the service, account and node behind it. curl -s -G https://mcp.inleed.com/api/v1/resolve -H "Authorization: Bearer $INLEED_TOKEN" \ --data-urlencode "[email protected]"