> ## Documentation Index
> Fetch the complete documentation index at: https://starcovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Streamable HTTP

> MCP Streamable HTTP endpoint (mcp-handler at /api/mcp). Auth: OAuth authorization_code (browser connectors), Authorization: Bearer, x-api-key, or last-resort ?api_key= (no anonymous, no session cookie). Tools: search_creators, list_campaigns, get_campaign, create_campaign, update_campaign, delete_campaign, generate_campaign_matches, add_campaign_match, remove_campaign_match, export_campaign, get_credits, list_api_keys, create_api_key, revoke_api_key. Agent access tokens cannot use list_api_keys, create_api_key, or revoke_api_key. Prefer auth.md for agent signup; path is protocol transport, not JSON CRUD API.



## OpenAPI

````yaml POST /api/mcp
openapi: 3.1.0
info:
  description: >-
    Starcovery helps you find and hire real Instagram and TikTok creators from a
    plain-language brief, on the web or from your agents. REST and MCP API.
    Search accepts unsigned callers. Campaigns, billing state, and keys accept
    browser session, x-api-key, or Bearer. MCP accepts OAuth, x-api-key, Bearer,
    or last-resort ?api_key= (no session). Machine Payments Protocol
    (x-payment-info) on GET /api/search when provisioned. Signup and claim at
    auth.md.
  title: Starcovery
  version: 1.0.0
servers:
  - url: https://www.starcovery.com
security: []
paths:
  /api/mcp:
    post:
      summary: MCP Streamable HTTP
      description: >-
        MCP Streamable HTTP endpoint (mcp-handler at /api/mcp). Auth: OAuth
        authorization_code (browser connectors), Authorization: Bearer,
        x-api-key, or last-resort ?api_key= (no anonymous, no session cookie).
        Tools: search_creators, list_campaigns, get_campaign, create_campaign,
        update_campaign, delete_campaign, generate_campaign_matches,
        add_campaign_match, remove_campaign_match, export_campaign, get_credits,
        list_api_keys, create_api_key, revoke_api_key. Agent access tokens
        cannot use list_api_keys, create_api_key, or revoke_api_key. Prefer
        auth.md for agent signup; path is protocol transport, not JSON CRUD API.
      responses:
        '200':
          description: MCP JSON-RPC / streamable HTTP response
        '401':
          description: >-
            unauthorized: missing or invalid credential; WWW-Authenticate
            challenge
        '429':
          description: Rate limited
      security:
        - ApiKeyHeader: []
        - BearerAuth: []
        - ApiKeyQuery: []
components:
  securitySchemes:
    ApiKeyHeader:
      description: Product API key or agent access token
      in: header
      name: x-api-key
      type: apiKey
    BearerAuth:
      bearerFormat: access token
      description: >-
        Bearer access token (agent registration), product API key, or MCP OAuth
        access token
      scheme: bearer
      type: http
    ApiKeyQuery:
      description: >-
        MCP last-resort fallback: product API key or access token in ?api_key=.
        Exposes key in logs, Referer, history. Use only when host cannot send
        Bearer or x-api-key. Prefer OAuth authorization_code for browser
        connectors.
      in: query
      name: api_key
      type: apiKey

````