Reference
API and MCP overview
How to reach your PYLO data from your own tools and from AI agents.
Three ways in
| Surface | For | Reference |
|---|---|---|
| Public API | Your own tools, dashboards and websites reading PYLO data over HTTPS | Public API reference |
| Agent API | Apps built on PYLO, such as an embedded Base44 app, that brand themselves for a workspace, show a member their board and file their forms as them | Agent API reference |
| MCP server | Claude and other MCP clients, as tools | MCP reference |
The references are generated from PYLO's live descriptions of itself, so they always match what the server does.
Tokens
Every request carries a token in the Authorization header as a Bearer token. Workspace tokens are issued under API tokens by an owner or admin, and agency tokens under Agency settings by an operator. Each is shown once when issued. Store it in your tool's secret settings, never in code or a shared document. Revoke a token there the moment you think it has leaked.
| Token | Looks like | Reaches |
|---|---|---|
| Workspace token | Starts with pylo_ | One workspace, read only |
| Member token | Starts with pylo_ | Only the team member it was issued for: their own board and their own forms. An embedded app gets one when the member signs in. |
| Agency token | Starts with pyla_ | Every workspace the agency runs, with the permissions chosen when it was issued. Name the workspace on each call. |
Check a token works
The first call to make is whoami. It names the workspace the token reaches, the token's kind and its scopes.
curl https://api.pylosystem.com/api/v1/whoami -H "Authorization: Bearer YOUR-TOKEN"
Limits and errors
Requests are rate limited per token. A response with status 429 means slow down and retry after the time it gives. A 401 means the token is missing, wrong or revoked. A 403 means the token is real but lacks the scope for that call.
The in-app page
The same public API is also described inside PYLO at developers, with examples you can copy.