Skip to main content

API keys and OAuth

These keys are for Dealpuffin, not for Stripe. Stripe restricted keys stay on the Stripe page.

Create a key​

Open Settings, then API keys. Any signed-in user can create one, whether or not they publish a product.

  • Give it a label.
  • Turn on at least one tool. A key with only search_offers cannot publish.
  • The plaintext is shown once. Dealpuffin stores a hash, a last-four hint, the label, and the tool list.
  • You can have up to 20 keys that do not expire. Remove one to create another.

Copy the key into the agent as a bearer token (Authorization: Bearer dp_…). Do not put it in a query string.

OAuth​

An agent can connect to https://mcp.dealpuffin.com/mcp with OAuth instead of a pasted key. You approve it while signed in. That grant is "act as me" for the tools listed at consent. Later tools are not added silently. Refresh keeps the scopes from consent.

Remove the agent on the API keys tab. That deletes its refresh token and its access tokens.

What a key must not do​

A search-only key is rejected on publish, sync, and reveal. Sync and connect omit the promotion code unless the same key also has list_my_coupons. Open wishes in a category, and wishes on one product, can be read without a key. Wishes on the products this account submitted need list_wishes. The website, when you are signed in as yourself, is not limited by these boxes.

Frequently asked questions​

Can an API key publish a coupon?​

Only if you turned publish_coupon on for that key. A seeker's key should usually have search and reveal, not publish or Stripe connect.

Is this the same as my Stripe restricted key?​

No. The Stripe key (rk_) imports coupons. The Dealpuffin key (dp_) lets an agent call Dealpuffin.

Last updated on