WeInc Developer Portal

Build and manage websites programmatically with the WeInc REST API and MCP server. Free plan, self-serve API keys, no sales call.

Quick start

Create a free account at https://weinc-coastside.vercel.app/signup. No credit card.
Create an organization, then generate an API key at https://weinc-coastside.vercel.app/agency/api. Keys start with wk_, are scoped to that organization, and can be revoked any time.
Call the API:

curl https://weinc-coastside.vercel.app/api/v1/projects \
  -H "Authorization: Bearer wk_YOUR_KEY"

Machine-readable resources

OpenAPI 3 spec : unique operationId and a description on every operation, typed schemas
API reference (human-readable) : every endpoint, parameters, responses, errors, pagination
API overview : Build with URL, embedding (OEM), MCP
MCP server manifest : Streamable HTTP server at https://weinc-coastside.vercel.app/api/mcp
OAuth protected-resource metadata (RFC 9728) : scopes_supported: mcp
OAuth authorization-server metadata (RFC 8414) : PKCE S256, dynamic client registration
Versioning and deprecation policy : URL versioning, Deprecation and Sunset headers, 12-month notice
llms.txt : index for AI assistants, with when-to-use guidance
MCP server source : first-party, MIT

Authentication

REST: Authorization: Bearer wk_... (organization API key with read and/or write permission).
MCP: OAuth 2.1 with PKCE (scope mcp) for Claude, ChatGPT and Cursor, or the same wk_ key as a bearer token. The handshake and tool list are readable without a token; tool calls need one.

Rate limits

100 requests per 60 seconds per credential. Every /api/v1 response reports the current state so a client can throttle itself:

RateLimit-Policy: "v1";q=100;w=60 (quota and window)
RateLimit: "v1";r=<remaining>;t=<seconds until reset>
X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (same values, legacy names)
On 429: Retry-After: <seconds>

Versioning

The version is in the URL path (/api/v1). Breaking changes only ship in a new path version; a retiring version announces itself with Deprecation and Sunset headers at least 12 months ahead. Full policy: /developers/versioning.

Webhooks

Register HTTPS endpoints with POST /api/v1/webhooks. Each delivery is signed with the secret returned when the endpoint was created. Events and payloads are in the API reference.

Support

hey@we.inc. Include your organization name and, for API errors, the request path and response body.