/// 01
Overview
Two surfaces, one workspace. Hit the REST API directly when you need raw CRUD, or wire the MCP server to Claude so it can act on your data without leaving the chat. Both share the same scoped API keys.
REST API
JSON over HTTPS at /api/v1. Bearer-authenticated. Same data model as the app.
MCP server
Native tools for Claude Code, Claude Desktop, and any MCP client. Stdio transport.
Poppy on tap
Ask grounded business questions and get answers that quote your own data.
/// 02
Quickstart
- 1
Create an API key
Open Settings → API keys, pick a name (e.g. "MCP server"), select the scopes you want to grant, and copy the bpk_live_… secret. It's shown exactly once.
- 2
Smoke-test the API
Hit /api/v1/me with your key to verify the tenant + scopes.
curl https://binpocket.com/api/v1/me \ -H "Authorization: Bearer bpk_live_<YOUR_KEY>"
- 3
Wire the MCP server
No git, no npm install. Download the single-file bundle from binpocket.com and register it with Claude Code.
# Zero-install path — single file, no git, no npm curl -O https://binpocket.com/mcp/binpocket-mcp.js BINPOCKET_API_KEY=bpk_live_xxx \ claude mcp add binpocket -- node $(pwd)/binpocket-mcp.js
Want to use a different AI? Fetch the prompt pack and paste it into the chat.
# Or: feed any AI the prompt pack curl https://binpocket.com/mcp/context.md
/// 03
Authentication
Every request must include a Bearer token in the Authorization header.
Authorization: Bearer bpk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- Keys are issued as bpk_live_<32 hex chars>. 41 chars total.
- Only the SHA-256 hash is stored. The raw value can never be retrieved.
- Each request bumps lastUsedAt — useful to spot stale keys.
- Revoke instantly from /settings/integrations/api-keys. Revoked keys return 401 key_revoked.
/// 04
Scopes
Each key carries one or more scopes. A scope unlocks a single permission on a single resource — never more. Combine multiple scopes on the same key when needed.
| /// Resource | /// Read scope | /// Write scope |
|---|---|---|
| products | products:read | products:write |
| customers | customers:read | customers:write |
| suppliers | suppliers:read | suppliers:write |
| partners | partners:read | partners:write |
| warehouses | warehouses:read | warehouses:write |
| purchases | purchases:read | purchases:write |
| sales | sales:read | sales:write |
| inventory | inventory:read | inventory:write |
| payments | payments:read | payments:write |
| reports | reports:read | — |
| poppy | poppy:ask | — |
| audit | audit:read | — |
/// 05
Endpoints
All endpoints live under /api/v1 and return JSON. Money is integer cents. Currencies are ISO 4217. Dates are ISO 8601.
| /// Method | /// Path | /// Required scope |
|---|---|---|
| GET | /api/v1/me | any |
| GET | /api/v1/morning-routine | reports:read |
| GET | /api/v1/kpi/snapshot | reports:read |
| GET | /api/v1/reports?kind=… | reports:read |
| GET | /api/v1/products | products:read |
| POST | /api/v1/products | products:write |
| GET | /api/v1/customers | customers:read |
| POST | /api/v1/customers | customers:write |
| GET | /api/v1/suppliers | suppliers:read |
| POST | /api/v1/suppliers | suppliers:write |
| GET | /api/v1/purchases | purchases:read |
| GET | /api/v1/purchases/[id] | purchases:read |
| POST | /api/v1/purchases | purchases:write |
| POST | /api/v1/purchases/[id]/status | purchases:write |
| PATCH | /api/v1/products/[id] | products:write |
| PATCH | /api/v1/customers/[id] | customers:write |
| PATCH | /api/v1/suppliers/[id] | suppliers:write |
| GET | /api/v1/sales | sales:read |
| GET | /api/v1/sales/[id] | sales:read |
| POST | /api/v1/sales | sales:write |
| POST | /api/v1/sales/[id]/status | sales:write |
| GET | /api/v1/payments | payments:read |
| POST | /api/v1/payments | payments:write |
| POST | /api/v1/stock/adjust | inventory:write |
| GET | /api/v1/forecast/sales | reports:read |
| GET | /api/v1/forecast/inventory | reports:read |
| GET | /api/v1/recommend | reports:read |
| GET | /api/v1/audit-log | audit:read |
| POST | /api/v1/poppy/ask | poppy:ask |
/// 06
MCP server
The MCP server wraps every REST endpoint as a typed tool. Configure it once, then ask Claude to operate your workspace in natural language.
Available tools
Register with Claude Code
BINPOCKET_API_KEY=bpk_live_xxx claude mcp add binpocket \ -- node /abs/path/to/Binpocket/mcp/dist/index.js
Claude Desktop
Add the following block to your claude_desktop_config.json.
{
"mcpServers": {
"binpocket": {
"command": "node",
"args": ["/abs/path/to/Binpocket/mcp/dist/index.js"],
"env": {
"BINPOCKET_URL": "https://binpocket.com",
"BINPOCKET_API_KEY": "bpk_live_..."
}
}
}
}/// 07
Examples
List products by SKU
curl https://binpocket.com/api/v1/products?q=AF-60 \ -H "Authorization: Bearer bpk_live_xxx"
Create a customer
curl -X POST https://binpocket.com/api/v1/customers \
-H "Authorization: Bearer bpk_live_xxx" \
-H "Content-Type: application/json" \
-d '{
"name": "ACME SARL",
"email": "[email protected]",
"country": "FR",
"currency": "EUR",
"taxRate": 20
}'Create a sales order with per-unit Nayax codes
curl -X POST https://binpocket.com/api/v1/sales \
-H "Authorization: Bearer bpk_live_xxx" \
-H "Content-Type: application/json" \
-d '{
"customerId": "cmo5rgtdn002pjs04sjj8znbd",
"currency": "EUR",
"taxRate": 20,
"lines": [{
"productId": "cmo5rgtdn0042js04sjj8znbe",
"qty": 4,
"unitPriceCents": 12000,
"nayaxCodes": ["AF-60-01", "AF-60-02", "AF-60-03", "AF-60-04"]
}]
}'Ask Poppy
curl -X POST https://binpocket.com/api/v1/poppy/ask \
-H "Authorization: Bearer bpk_live_xxx" \
-H "Content-Type: application/json" \
-d '{ "question": "Which customer drove the most margin this quarter?" }'/// 08
Security
Hash-only storage
We never store the raw key. Verification compares SHA-256 hashes in constant time.
Least privilege by design
Pick scopes per integration. A read-only key cannot create or mutate anything.
Audit-logged writes
Every record created via an API key is tagged with the key's id in the workspace audit log.
Tenant isolation
Keys are scoped to a single workspace. Cross-tenant access is structurally impossible.
/// 09
FAQ
- Can I use the API without the MCP server?
- Yes. The REST API is independent — curl, fetch, requests, anything that speaks HTTPS.
- Is there a rate limit?
- Per-tenant fair-use limits apply. Hard limits will be published before they're enforced.
- Can the MCP server run remotely?
- Yes. It only needs network access to your Binpocket URL and the API key. Run it on any machine that hosts your MCP-aware LLM.
- How do I rotate a key?
- Issue a new key, swap it in the consuming client, then revoke the old one. The two keys can coexist during the swap.