Documentation
AI Agents (MCP)
Let Claude or another AI agent create and manage your apps
WebToApp runs a Model Context Protocol (MCP) server. Give an AI agent such as Claude an API token and it can do what you would do in the dashboard: create an app from a URL, set the logo and colours, configure permissions and integrations, request builds, check their status and hand you the download links.
1. Create an API token
Open Settings → API tokens & AI agents in your dashboard, name the token and pick what it may do. The token is shown once; copy it then. Tokens can expire and can be revoked at any time, which cuts off the agent immediately.
| Permission | What the agent can do |
|---|---|
read (always) | List apps and builds, see your credit balance and prices, get temporary download links for finished builds. |
write | Create apps, change settings, set the logo, configure OneSignal and AdMob, request free demo builds, delete apps. |
spend | Anything that costs credits: production builds, add-ons, cancelling builds (credits are refunded), and Stripe checkout links to buy credits. |
publish | Publish an app, save your App Store Connect API key, use your own iOS signing certificate. |
Start with read and write. Add spend only when you want the agent to be able to use your credits.
2. Connect your agent
The endpoint is https://www.webtoapp.app/api/mcp and the token goes in an Authorization: Bearer header.
Claude Code
claude mcp add --transport http webtoapp https://www.webtoapp.app/api/mcp --header "Authorization: Bearer wta_your_token"Other MCP clients (Cursor, VS Code, and similar)
{
"mcpServers": {
"webtoapp": {
"url": "https://www.webtoapp.app/api/mcp",
"headers": { "Authorization": "Bearer wta_your_token" }
}
}
}Claude API (MCP connector)
"mcp_servers": [{
"type": "url",
"name": "webtoapp",
"url": "https://www.webtoapp.app/api/mcp",
"authorization_token": "wta_your_token"
}]The client has to support sending a custom header (or an authorization token). Connectors that only offer browser sign-in (OAuth) cannot use API tokens yet.
3. Ask for what you want
Create an app for https://mystore.com called "My Store" with this logo:
https://mystore.com/logo.png. Use a dark blue splash screen, turn on the camera
permission, and tell me when the demo builds are ready.Tools
| Tool | Permission | What it does |
|---|---|---|
get_account | read | Credit balance and what builds, add-ons and credit packs cost |
list_apps, get_app | read | Your apps, and one app's full configuration with what is missing to publish |
list_builds, get_build_download_url | read | Build history with failure reasons, and 30-minute download links |
list_credit_transactions | read | Purchases, build holds and refunds |
create_app | write | New app from a URL (and optional logo URL); free demo builds start automatically |
update_app, set_app_logo | write | Name, category, WebView, splash and colours, versions, deep links, permissions, age compliance, icon |
configure_integrations | write | OneSignal and AdMob settings (add-on must be unlocked) |
request_demo_build | write | Free Android APK or iOS simulator demo |
delete_app | write | Permanent deletion; needs the exact app name and explicit confirmation |
request_build, cancel_build | spend | Production Android or iOS build, and cancelling a queued or failed one |
unlock_addon | spend | Unlock OneSignal, AdMob or FCM for an app |
create_credit_checkout | spend | A Stripe link for you to pay; nothing is charged until you do |
publish_app | publish | Validate and publish the configuration |
connect_app_store_connect | publish | Save your App Store Connect API key for iOS builds |
list_signing_certificates, upload_signing_certificate | publish | See your Apple team's certificates, or sign with your own .p12 |
Staying in control
- A token only ever acts on your own apps and credits, and never as an administrator.
- Tools that spend credits or delete data refuse to run without an explicit
confirmfrom the agent, and tell it to ask you first. - Private keys and passwords you give the agent are stored encrypted and are never returned by any tool.
- Revoking a token in Settings stops it immediately. Treat tokens like passwords and never paste them into a website or a public repository.
- Not available through MCP, by design: revoking Apple certificates, custom Android keystores, and Firebase Cloud Messaging files. Use the dashboard for those. You still submit to the App Store and Google Play yourself.