# API and MCP overview

How to reach your PYLO data from your own tools and from AI agents.

## Three ways in

| Surface | For | Reference |
|---|---|---|
| Public API | Your own tools, dashboards and websites reading PYLO data over HTTPS | [Public API reference](/docs/reference/public-api) |
| Agent API | Apps built on PYLO, such as an embedded Base44 app, that brand themselves for a workspace, show a member their board and file their forms as them | [Agent API reference](/docs/reference/agent-api) |
| MCP server | Claude and other MCP clients, as tools | [MCP reference](/docs/mcp) |

The references are generated from PYLO's live descriptions of itself, so they always match what the server does.

## Tokens

Every request carries a token in the Authorization header as a Bearer token. Workspace tokens are issued under [API tokens](/docs/settings/api-tokens) by an owner or admin, and agency tokens under [Agency settings](/docs/agency/settings) by an operator. Each is shown once when issued. Store it in your tool's secret settings, never in code or a shared document. Revoke a token there the moment you think it has leaked.

| Token | Looks like | Reaches |
|---|---|---|
| Workspace token | Starts with pylo_ | One workspace, read only |
| Member token | Starts with pylo_ | Only the team member it was issued for: their own board and their own forms. An embedded app gets one when the member signs in. |
| Agency token | Starts with pyla_ | Every workspace the agency runs, with the permissions chosen when it was issued. Name the workspace on each call. |

## Check a token works

The first call to make is whoami. It names the workspace the token reaches, the token's kind and its scopes.

```
curl https://api.pylosystem.com/api/v1/whoami -H "Authorization: Bearer YOUR-TOKEN"
```

## Limits and errors

Requests are rate limited per token. A response with status 429 means slow down and retry after the time it gives. A 401 means the token is missing, wrong or revoked. A 403 means the token is real but lacks the scope for that call.

## The in-app page

The same public API is also described inside PYLO at [developers](/developers/api), with examples you can copy.