# DubSmart MCP server and REST API

DubSmart can be integrated with conventional applications through a REST API and with compatible AI agents through a remote Model Context Protocol (MCP) server.

## Quick links

- Developer guide: https://dubsmart.ai/developers
- Token management: https://dubsmart.ai/dashboard/api
- Interactive REST API reference: https://dubsmart.ai/dashboard/docs
- OpenAPI JSON: https://dubsmart.ai/api/openapi.json
- MCP endpoint: https://mcp.dubsmart.ai/mcp
- MCP health: https://mcp.dubsmart.ai/mcp/health

## Connect an MCP client

1. Sign in at https://dubsmart.ai.
2. Open https://dubsmart.ai/dashboard/api.
3. Choose **Create MCP token**.
4. Select the narrowest access preset that fits the workflow: `READ_ONLY`, `CREATOR`, or `FULL_ACCESS`.
5. Copy the `dsmcp_` secret when it is shown. It cannot be recovered later.
6. Configure a client that supports remote Streamable HTTP servers and custom headers:

```json
{
    "mcpServers": {
        "dubsmart": {
            "url": "https://mcp.dubsmart.ai/mcp",
            "headers": {
                "Authorization": "Bearer dsmcp_YOUR_TOKEN"
            }
        }
    }
}
```

MCP tokens expire after 90 days and can be revoked at any time. Mutating tools require an `idempotency_key`. Credit-consuming and sensitive tools first return a short-lived confirmation token that must be supplied to the confirmed call.

The current release uses bearer tokens. OAuth-based one-click connectors are not yet supported.

## Call the REST API

Create an API key at https://dubsmart.ai/dashboard/api and pass it as a bearer token:

```bash
curl -X POST "https://dubsmart.ai/api/v1/voices" \
  -H "Authorization: Bearer dsapi_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit": 20, "filter": {"language": "en"}}'
```

Use https://dubsmart.ai/api/openapi.json as the source of truth for paths, methods, request bodies, and response schemas.

## Security notes

- Keep API and MCP secrets out of prompts, source control, browser URLs, and logs.
- Use separate tokens for separate clients or environments.
- Prefer `READ_ONLY` or `CREATOR`; reserve `FULL_ACCESS` for a trusted client that needs destructive or administrative actions.
- Revoke a token immediately if it may have been exposed.

## Machine-readable resources

- https://dubsmart.ai/llms.txt
- https://dubsmart.ai/llms-full.txt
- https://dubsmart.ai/mcp-server.json
- https://dubsmart.ai/api/openapi.json