Beta

dPlaza for developers

Point an AI agent at your store over MCP (Model Context Protocol) and let it read orders, manage products, and check payouts, scoped to your store only.

Compatibility

Works today with Claude Code and any MCP-compatible CLI that can speak streamable HTTP MCP with a Bearer token.

Claude.ai and ChatGPT custom connectors are not supported yet. Both require OAuth 2.1 plus RFC 7591 dynamic client registration, a later phase of this work.

Status

Endpoint	Beta	https://www.dplaza.io/api/mcp
Auth	Beta	Bearer token, SHA-256 hashed keys
Transport	Beta	Stateless JSON-RPC 2.0 over HTTP POST, no SSE channel
Claude Code	Beta	Works today via a plain HTTP MCP server entry
MCP CLIs	Beta	Any client that speaks streamable HTTP MCP
Claude.ai connector	Not available	Needs OAuth 2.1 + dynamic client registration
OAuth DCR	Not available	RFC 7591, not built yet

30 tools, by category

45 tools exist on the platform. 30 are available to a store-scoped API key. The rest are superadmin-only ops tools and not exposed here.

Money & payouts8 tools

Full tool catalog

Stores4 tools

read

dp_list_stores

List stores, optionally filtered by status and/or limit.

read

dp_get_store

Get a single store by slug, returning the full store row.

read

dp_get_store_community_links

Get a store's community links by store_id or store_slug, with the store's name and slug included for context.

write

dp_update_store

Update store fields, passing only the fields to change.

Products4 tools

read

dp_list_products

List products, optionally filtered by store_slug, status, and/or limit.

write

dp_create_product

Create a product, with sensible defaults for status, type, and stock tracking.

write

dp_update_product

Update product fields, passing only the fields to change.

write

dp_archive_product

Set a product's status to archived.

Orders3 tools

read

dp_list_orders

List orders, excluding bypass orders, optionally filtered by store_slug, status, and/or limit.

read

dp_get_order

Get a single order by ID, including its order_items.

write

dp_update_order_status

Update an order's status, tracking code, and/or notes through the same validated transition the admin dashboard uses.

Customers1 tools

read

dp_list_customers

List a store's customers derived from order history: order count, total spent, and first/last order date.

Money & payouts8 tools

read

dp_get_store_balance

Get a store's live on-chain USDC balance summary: available balance, total earnings, total withdrawn, and pending withdrawals.

read

dp_list_withdrawals

List a store's withdrawal history with narrow columns only, newest first.

write

dp_refund_orderpayoutsidempotency key requireddestructive

Issue a Stripe refund on a card order. Moves money and is irreversible.

write

dp_create_withdrawalpayoutsidempotency key requireddestructive

Withdraw store USDC on-chain to a verified saved recipient or the store owner's wallet. Moves money and is irreversible once broadcast.

write

dp_cancel_withdrawalpayouts

Cancel a pending withdrawal before it starts processing on-chain.

read

dp_list_withdrawal_recipients

List a store's saved withdrawal recipients and eligible owner wallets, the only valid destinations for a withdrawal.

read

dp_get_stripe_connect_status

Get a store's live Stripe Connect onboarding/payout status plus a payout summary.

write

dp_create_stripe_onboarding_linkpayouts

Mint a Stripe Connect Express onboarding link for a store, to be opened by the store owner in a browser.

Analytics4 tools

read

dp_get_revenue_analytics

Get revenue analytics by period (today, week, month, or all), excluding bypass orders.

read

dp_order_stats

Get order counts by status across all orders.

read

dp_get_store_financials

Get a per-store revenue breakdown by period, excluding bypass orders.

read

dp_analytics_timeseries

Get revenue and order counts bucketed by day, week, or month for a date range, excluding bypass orders.

Theme1 tools

write

dp_set_store_theme

Set a store's theme by theme_id, writing theme_id, theme_overrides, and the derived legacy theme column together.

API keys1 tools

write

dp_rotate_api_key

Rotate the calling store-scoped API key: create a new key with the same scope and permissions, then revoke the calling key.

Store admins4 tools

write

dp_invite_store_admin

Invite a user to become a store admin or editor, sending an invite email with a 7-day token.

read

dp_list_store_invites

List invite records for a store, optionally filtered by status.

write

dp_cancel_store_invite

Cancel a pending store admin invite by invite_id.

write

dp_remove_store_admin

Remove an admin from a store, with rules protecting the last admin and last owner.

Scopes and permissions

Every store-scoped key can call every read tool and the write tools above. Moving money is separate: the payouts permission is not granted by default, and only a key with it can call 4 of the 8money tools. A store admin turns it on explicitly (the "Payouts & refunds" checkbox) when creating a key.

dp_refund_order

Issue a Stripe refund on a card order. Moves money and is irreversible.

dp_create_withdrawal

Withdraw store USDC on-chain to a verified saved recipient or the store owner's wallet. Moves money and is irreversible once broadcast.

dp_cancel_withdrawal

Cancel a pending withdrawal before it starts processing on-chain.

dp_create_stripe_onboarding_link

Mint a Stripe Connect Express onboarding link for a store, to be opened by the store owner in a browser.

2 of those also require an idempotency_key: dp_refund_order and dp_create_withdrawal. A repeat call with the same key replays the first result instead of moving money again, because the same key can never charge or move money twice.

Tools marked destructive in the catalog above are irreversible: refunds, withdrawals, and (on the ops-level tier) key revocation. There is no undo call.

Get a key

As a store admin, open your store's admin panel, go to Settings, then click the API Keys tab, and create a key:

/<your-store-slug>/admin/settings

Pick read-only or read+write, optionally enable Payouts & refunds, set an optional expiry, and copy the key. It is shown once. A store-scoped key cannot read or mutate another store: every tool call is checked against the key's own store_id.

Copy-paste config

The transport is stateless JSON-RPC 2.0 over HTTP POST. There is no SSE channel; GET returns 405 by design.

.mcp.json

{
  "mcpServers": {
    "dplaza": {
      "type": "http",
      "url": "https://www.dplaza.io/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_KEY"
      }
    }
  }
}

Smoke test

curl -X POST "https://www.dplaza.io/api/mcp" \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

The Accept: application/json, text/event-stream header is required. This route has no Accept-header shim: a POST without it returns 406.

Rate limits

120 requests per minute per API key, burstable up to 120 and refilling at 2 requests per second (token bucket). Exceeding it returns HTTP 429 with a Retry-After header, so batch your work instead of polling in a tight loop.

A separate limit of 30 failed authentication attempts per minute per IP address applies on top of the per-key limit above.

Included with your account.

Status

Endpoint	Beta	https://www.dplaza.io/api/mcp
Auth	Beta	Bearer token, SHA-256 hashed keys
Transport	Beta	Stateless JSON-RPC 2.0 over HTTP POST, no SSE channel
Claude Code	Beta	Works today via a plain HTTP MCP server entry
MCP CLIs	Beta	Any client that speaks streamable HTTP MCP
Claude.ai connector	Not available	Needs OAuth 2.1 + dynamic client registration
OAuth DCR	Not available	RFC 7591, not built yet

Full tool catalog

Stores4 tools

read

dp_list_stores

List stores, optionally filtered by status and/or limit.

read

dp_get_store

Get a single store by slug, returning the full store row.

read

dp_get_store_community_links

Get a store's community links by store_id or store_slug, with the store's name and slug included for context.

write

dp_update_store

Update store fields, passing only the fields to change.

Products4 tools

read

dp_list_products

List products, optionally filtered by store_slug, status, and/or limit.

write

dp_create_product

Create a product, with sensible defaults for status, type, and stock tracking.

write

dp_update_product

Update product fields, passing only the fields to change.

write

dp_archive_product

Set a product's status to archived.

Orders3 tools

read

dp_list_orders

List orders, excluding bypass orders, optionally filtered by store_slug, status, and/or limit.

read

dp_get_order

Get a single order by ID, including its order_items.

write

dp_update_order_status

Update an order's status, tracking code, and/or notes through the same validated transition the admin dashboard uses.

Customers1 tools

read

dp_list_customers

List a store's customers derived from order history: order count, total spent, and first/last order date.

Money & payouts8 tools

read

dp_get_store_balance

Get a store's live on-chain USDC balance summary: available balance, total earnings, total withdrawn, and pending withdrawals.

read

dp_list_withdrawals

List a store's withdrawal history with narrow columns only, newest first.

write

dp_refund_orderpayoutsidempotency key requireddestructive

Issue a Stripe refund on a card order. Moves money and is irreversible.

write

dp_create_withdrawalpayoutsidempotency key requireddestructive

Withdraw store USDC on-chain to a verified saved recipient or the store owner's wallet. Moves money and is irreversible once broadcast.

write

dp_cancel_withdrawalpayouts

Cancel a pending withdrawal before it starts processing on-chain.

read

dp_list_withdrawal_recipients

List a store's saved withdrawal recipients and eligible owner wallets, the only valid destinations for a withdrawal.

read

dp_get_stripe_connect_status

Get a store's live Stripe Connect onboarding/payout status plus a payout summary.

write

dp_create_stripe_onboarding_linkpayouts

Mint a Stripe Connect Express onboarding link for a store, to be opened by the store owner in a browser.

Analytics4 tools

read

dp_get_revenue_analytics

Get revenue analytics by period (today, week, month, or all), excluding bypass orders.

read

dp_order_stats

Get order counts by status across all orders.

read

dp_get_store_financials

Get a per-store revenue breakdown by period, excluding bypass orders.

read

dp_analytics_timeseries

Get revenue and order counts bucketed by day, week, or month for a date range, excluding bypass orders.

Theme1 tools

write

dp_set_store_theme

Set a store's theme by theme_id, writing theme_id, theme_overrides, and the derived legacy theme column together.

API keys1 tools

write

dp_rotate_api_key

Rotate the calling store-scoped API key: create a new key with the same scope and permissions, then revoke the calling key.

Store admins4 tools

write

dp_invite_store_admin

Invite a user to become a store admin or editor, sending an invite email with a 7-day token.

read

dp_list_store_invites

List invite records for a store, optionally filtered by status.

write

dp_cancel_store_invite

Cancel a pending store admin invite by invite_id.

write

dp_remove_store_admin

Remove an admin from a store, with rules protecting the last admin and last owner.

Scopes and permissions

dp_refund_order

Issue a Stripe refund on a card order. Moves money and is irreversible.

dp_create_withdrawal

Withdraw store USDC on-chain to a verified saved recipient or the store owner's wallet. Moves money and is irreversible once broadcast.

dp_cancel_withdrawal

Cancel a pending withdrawal before it starts processing on-chain.

dp_create_stripe_onboarding_link

Mint a Stripe Connect Express onboarding link for a store, to be opened by the store owner in a browser.

Tools marked destructive in the catalog above are irreversible: refunds, withdrawals, and (on the ops-level tier) key revocation. There is no undo call.

Get a key

As a store admin, open your store's admin panel, go to Settings, then click the API Keys tab, and create a key:

/<your-store-slug>/admin/settings

Copy-paste config

The transport is stateless JSON-RPC 2.0 over HTTP POST. There is no SSE channel; GET returns 405 by design.

.mcp.json

{
  "mcpServers": {
    "dplaza": {
      "type": "http",
      "url": "https://www.dplaza.io/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_KEY"
      }
    }
  }
}

Smoke test

curl -X POST "https://www.dplaza.io/api/mcp" \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

The Accept: application/json, text/event-stream header is required. This route has no Accept-header shim: a POST without it returns 406.

Rate limits

A separate limit of 30 failed authentication attempts per minute per IP address applies on top of the per-key limit above.