openapi.json

Sidekick Pro API

Overview

Version: 1.0.0
Summary: Public and agent-facing HTTP surface of Sidekick Pro.
Description: Sidekick Pro is an AI executive assistant for solo operators and small businesses.

This description covers the endpoints an external agent or integrator can call: the MCP server at /mcp, its OAuth 2.1 authorization endpoints, and the public catalog and health endpoints. The product's own first-party app endpoints are authenticated with session cookies and are not part of this contract.

Agents should start at GET /.well-known/oauth-protected-resource, which is the machine-readable entry point for the MCP server.

Authorization is delegated in full — see the sidekickOAuth security scheme.

Human-readable documentation lives at Sidekick Pro Developers. A Markdown index of the whole site for LLM consumption lives at LLM Index.

Terms of Service

Terms of Service

Contact

• Name: Sidekick Pro
• URL: Sidekick Pro Developers
• Email: hello@sidekickpro.com

Server Information

• URL: https://sidekickpro.com
• Description: Production

External Documentation

• Description: Sidekick Pro developer documentation
• URL: Sidekick Pro Developers

Tags

• MCP: Model Context Protocol server. Gives an agent one tool, messageSidekick.
• OAuth: OAuth 2.1 authorization for the MCP server. Scoped, with PKCE and dynamic client registration.
• Catalog: Public, unauthenticated product catalog.
• Status: Service health.

Security Schemes

sidekickOAuth

• Type: oauth2
• Description: OAuth 2.1 authorization code flow with PKCE (S256) and RFC 7591 dynamic client registration. The server issues a single scope, mcp:tools, which grants an agent the same assistant access the signed-in user has.

Authorization Flows

• authorizationCode
  • Authorization URL: https://sidekickpro.com/mcp/oauth/authorize
  • Token URL: https://sidekickpro.com/mcp/oauth/token
  • Refresh URL: https://sidekickpro.com/mcp/oauth/token
  • Scopes:
    • mcp:tools: Full assistant access.

Endpoints

Protected Resource Metadata

• GET /.well-known/oauth-protected-resource
  • Summary: Protected resource metadata for the MCP server
  • Description: RFC 9728. The discovery entry point: it names the authorization server and the scopes this resource understands.
  • Responses:
    • 200: Resource metadata

Authorization Server Metadata

• GET /.well-known/oauth-authorization-server
  • Summary: Authorization server metadata
  • Description: RFC 8414. Lists the authorize, token and registration endpoints, the supported grants, and scopes_supported.
  • Responses:
    • 200: Authorization server metadata

Dynamic Client Registration

• POST /mcp/oauth/register
  • Summary: Dynamic client registration
  • Description: RFC 7591. Register a client and receive a client_id and client_secret.
  • Request Body:
    • Required: true
    • Content: application/json

Authorization Endpoint

• GET /mcp/oauth/authorize
  • Summary: Authorization endpoint
  • Description: Authorization code flow with PKCE.
  • Responses:
    • 200: Consent page
    • 302: Redirect to the client's redirect_uri

Token Endpoint

• POST /mcp/oauth/token
  • Summary: Token endpoint
  • Description: Exchanges an authorization code for tokens, or rotates a refresh token.
  • Responses:
    • 200: Tokens issued

MCP Server

• POST /mcp
  • Summary: MCP server
  • Description: Model Context Protocol endpoint.
  • Responses:
    • 200: JSON-RPC response
    • 401: No valid bearer token.

Public Plan Catalog

• GET /v1/billing/plan-cards
  • Summary: Public plan catalog
  • Description: The pricing-card copy for each plan.
  • Responses:
    • 200: Plan cards

Service Health Check

• GET /v1/healthcheck
  • Summary: Service health
  • Responses:
    • 200: Service is up.