Ambassly MCP server

Connect an AI coding assistant to Ambassly with a scoped API key. Company keys can operate the merchant dashboard; affiliate keys can operate the creator portal.

The live guide with full Claude Code, Claude Desktop, and Cursor config lives at docs/mcp.

Endpoint and auth

Streamable HTTP endpoint: https://ambassly.com/api/mcp

Mint a key in Dashboard or Portal settings, then send it as a bearer token:

Authorization: Bearer amb_YOUR_API_KEY

Claude Code

claude mcp add --transport http ambassly https://ambassly.com/api/mcp \
  --header "Authorization: Bearer amb_YOUR_API_KEY"

Cursor

{
  "mcpServers": {
    "ambassly": {
      "url": "https://ambassly.com/api/mcp",
      "headers": {
        "Authorization": "Bearer amb_YOUR_API_KEY"
      }
    }
  }
}

Tools

Company key tools:

• Programs: list_programs, create_program, update_program, get_program_stats.
• Affiliates: list_affiliates, get_affiliate, create_affiliate (direct enrolment, optional custom ?via= code, idempotent per email and program), create_affiliate_invite, set_affiliate_code, create_affiliate_link.
• Referrals and commissions: list_referrals, list_commissions, list_pending_commissions, approve_commission, reject_commission, get_payout_batch.
• Stripe webhook secrets: add_stripe_webhook_secret, remove_stripe_webhook_secret, list_stripe_webhook_secrets.

add_stripe_webhook_secret takes label, webhook_secret (whsec_...), optional stripe_account_id (acct_...) and optional replace (overwrite the secret under an existing label, for example after rotating an endpoint). It stores an additional Stripe signing secret for your company (up to 10); the secret is never returned. Any company API key can register a secret, so guard your company keys; every add, replace and remove is logged. remove_stripe_webhook_secret deletes one by label. list_stripe_webhook_secrets returns every accepted secret (your main one as primary) masked as whsec_… plus its last four characters.

Affiliate key tools: my_stats, my_links, create_link.

Notes: referral codes are unique across all merchants. set_affiliate_code breaks links that use the old code and only works on active memberships. create_affiliate enrols as active only when it creates a brand new affiliate account; an existing account is always invited and must accept. Removed affiliates cannot be re-enrolled. update_program changes to recurring settings affect future renewals of existing referrals.

API keys are shown once. Ambassly stores only a SHA-256 hash, plus a short prefix so you can recognize and revoke keys later.

For the full Claude Desktop config and example session, see docs/mcp.