Account

API, CLI & MCP

Three surfaces, one token type, one set of permissions. Whatever the dashboard can show you, an agent with the right scope can read — and nothing dangerous is reachable from any of them.

Create a token

Tokens are scoped: pick the projects they can see and read or write per resource. A coding agent can read analytics without also being able to delete a project.
  1. 1Open Settings → API / MCP — at account level under Preferences, or inside a project's settings.
  2. 2Choose the websites in scope and the permission per resource.
  3. 3Name it after where it will live ("laptop CLI", "Cursor", "billing job") so revoking the right one later is obvious.
  4. 4Copy the sei_ secret. It is shown once — only its hash is stored.
The API / MCP settings tab with the create-token action
Settings → API / MCP. The same panel lists live tokens and revokes them.

Calling the API

curl https://www.seiton.online/api/v1/projects \
  -H "Authorization: Bearer sei_xxx"
  • Base URL https://www.seiton.online/api/v1, bearer auth, JSON in and out.
  • Every response is the same envelope: { "status": "success", "data": … } or { "status": "error", "error": { code, message } }.
  • 60 requests per token per minute. A 429 carries limit, remaining and reset.
  • Resources mirror the dashboard: projects, health, briefing, analytics, revenue, churn, SEO, signals, integrations, expenses, notifications and tokens.
CodeMeaning
401Missing or invalid token.
402Trial expired — subscribe to continue.
403The token lacks that permission, or the action is dashboard-only.
404No such project, token or resource.
429Rate limited.

Some things stay in the dashboard

Deleting a website and connecting or disconnecting a payment provider are refused with a 403 on every surface. Those are decisions with money attached, and an agent should not be able to make them on your behalf.

The three surfaces

Each of those pages is also available as raw markdown for agents — the link is at the top of every one. Same content, no HTML to parse.

Keeping tokens safe

  • Never put a sei_ token in frontend code or a public repository.
  • Scope down rather than up. A read-only token for one project is the right default for an agent.
  • Revoke from the same panel that created it. A revoked token stops working immediately, on all three surfaces.
  • Something went wrong with a token you cannot find? Troubleshooting covers the common cases.