Sidekick Pro API and Developer Docs | MCP Server, OAuth, llms.txt

The Sidekick Pro MCP server

Sidekick Pro speaks the Model Context Protocol. Point any MCP client at the endpoint below and it will discover a single tool, messageSidekick, which takes a natural-language message for the user's assistant and returns the assistant's reply.

| Endpoint | POST https://sidekickpro.com/mcp | | Transport | Streamable HTTP | | Tool | messageSidekick({ message: string }) | | Auth | OAuth 2.1 bearer token, or a signed-in Sidekick Pro session cookie |

The assistant behind that tool has the user's email, calendar, tasks, documents, contacts, phone and SMS, memory, and connected apps, and an authorized connection can reach all of it. See Authorization before you store a token.

Authorization

Authorization is OAuth 2.1: authorization code flow with PKCE (S256) and RFC 7591 dynamic client registration, so a client can register itself with no manual onboarding. Discovery starts at /.well-known/oauth-protected-resource.

Authorization is all-or-nothing today. The server issues one scope, mcp:tools, and there is no narrower one to request. A token for this server reaches the assistant with every tool enabled, so treat it as equivalent to the user's own access and store it accordingly.

The user sees which client is asking, and what it will be able to do, on a consent screen before approving. The token response states the scope granted.

# Discover the authorization server
curl -s https://sidekickpro.com/.well-known/oauth-protected-resource

# Register a client
curl -s -X POST https://sidekickpro.com/mcp/oauth/register \
  -H 'Content-Type: application/json' \
  -d '{"client_name":"My Agent","redirect_uris":["https://example.com/callback"]}'

# Send the user to authorize
https://sidekickpro.com/mcp/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256

Markdown for agents

Every page on this site has a Markdown twin, generated from the page itself at build time so it never drifts. Two ways to get it:

# Content negotiation on the same URL
curl -sH 'Accept: text/markdown' https://sidekickpro.com/teams

# Or the explicit .md twin
curl -s https://sidekickpro.com/teams.md

Negotiated responses carry Vary: Accept, Accept-Encoding, so a cache never hands the HTML variant to a client that asked for Markdown. HTML responses also advertise the twin with a Link: </teams.md>; rel="alternate"; type="text/markdown" header. A request that accepts neither type gets 406 rather than a silent fallback.

Unknown URLs

A path that does not exist returns a real HTTP 404, never a 200 with an app shell. Clients that ask for Markdown, and clients that name no media type at all, get a short Markdown body that links this page, llms.txt, and the sitemap, so an agent can recover from a wrong guess in one more request.

curl -s -o /dev/null -w '%{http_code}\n' https://sidekickpro.com/no-such-page
# 404

curl -sH 'Accept: text/markdown' https://sidekickpro.com/no-such-page

Machine-readable files

• openapi.json OpenAPI 3.1 description of the Sidekick Pro API, including the OAuth security scheme and what its scope permits.
• .well-known/oauth-protected-resource RFC 9728 protected resource metadata. Start MCP discovery here.
• .well-known/oauth-authorization-server RFC 8414 authorization server metadata: endpoints, grants, and scopes_supported.
• llms.txt Curated index of every page, linking the Markdown twin of each.
• llms-full.txt The whole site as one Markdown document.
• sitemap-index.xml XML sitemap for crawlers.
• robots.txt Crawl policy. Everything public is allowed.

Questions

Does Sidekick Pro have an MCP server? Yes. The Sidekick Pro MCP server is at https://sidekickpro.com/mcp over the Streamable HTTP transport. It exposes one tool, messageSidekick, which sends a natural-language message to your assistant and returns its reply.

How do I authenticate against the Sidekick Pro API? With OAuth 2.1: authorization code flow, PKCE (S256), and RFC 7591 dynamic client registration. Discovery starts at https://sidekickpro.com/.well-known/oauth-protected-resource.

What OAuth scopes does Sidekick Pro support? One: mcp:tools. It grants an agent the same assistant access the signed-in user has. There is currently no narrower scope, so treat a Sidekick Pro token as equivalent to the user’s own access.

Where is the Sidekick Pro OpenAPI spec? At https://sidekickpro.com/openapi.json. It is OpenAPI 3.1 and declares the OAuth 2.1 security scheme and what its scope permits.

Can I read Sidekick Pro pages as Markdown? Yes. Send Accept: text/markdown to any marketing URL, or append .md to it. https://sidekickpro.com/llms.txt indexes every page and https://sidekickpro.com/llms-full.txt is the whole site as one Markdown file.