monsterstack.kaik.io developer & agent API

Everything needed to build against https://monsterstack.kaik.io: identify your client, get a token, call the API. See how clients are identified below.

Get credentials

The registration endpoint (https://monsterstack.kaik.io/api/oauth/register, advertised as registration_endpoint in the authorization server metadata) issues credentials for pre-registered vendor platforms only: it matches your client_name against a known integration and returns that platform's client_id. It is not open dynamic client registration (RFC 7591) — an unrecognized client_name is refused with invalid_client_metadata.

A client we have not pre-registered is not issued credentials here — an unrecognized client_name is refused with invalid_client_metadata. Contact support or see https://docs.loopwise.com before building against this endpoint.

Registering here gives you a client that acts for a site operator. To act for a signed-in member — their enrollments, progress and orders — the site registers you: an operator creates the client in the site's own admin area (Developers → OAuth applications, which appears once they enable the “MCP connections” beta feature), picks its scopes, and hands you the client_id. Anyone with a role at that site can then authorize it, students included. There is no self-serve route to one, because a member token reads one person's data at one site and the site decides who may hold one.

The two differ in what they may ask for: account:read and account:write belong to the member audience, so an operator client requesting either is refused with invalid_scope, and a member client is limited to the scopes its operator selected.

Purpose	Endpoint
Client registration	`https://monsterstack.kaik.io/api/oauth/register`
Authorization	`https://monsterstack.kaik.io/oauth/authorize`
Token	`https://monsterstack.kaik.io/api/oauth/token`
UserInfo	`https://monsterstack.kaik.io/api/oauth/userinfo`
Revocation	`https://monsterstack.kaik.io/api/oauth/revoke`

Authenticate

Authorization Code flow with PKCE (S256). Public clients use the none token-endpoint auth method, confidential clients client_secret_post.

1. Identify your client. A recognized vendor platform POSTs its client_name to https://monsterstack.kaik.io/api/oauth/register to obtain its client_id; any other client contacts support (see “Get credentials”).

2. Send the person to the authorization endpoint with your PKCE challenge:

https://monsterstack.kaik.io/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&scope=openid%20profile%20courses:read&code_challenge=CODE_CHALLENGE&code_challenge_method=S256&state=RANDOM

3. Exchange the returned code for tokens:

curl -X POST https://monsterstack.kaik.io/api/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=authorization_code' \
  -d 'code=AUTHORIZATION_CODE' \
  -d 'redirect_uri=YOUR_REDIRECT_URI' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'code_verifier=CODE_VERIFIER'

4. Call the API:

curl https://monsterstack.kaik.io/api/oauth/userinfo \
  -H 'Authorization: Bearer ACCESS_TOKEN'

Refresh with the refresh_token grant, and revoke at https://monsterstack.kaik.io/api/oauth/revoke (RFC 7009). Errors follow RFC 6749 §5.2: a JSON body with error and error_description; an invalid token is 401 invalid_token and a token missing a scope is 403 insufficient_scope. The full walkthrough is at /auth.md.

Scopes

Scope	Grants
`openid`	OpenID Connect authentication
`profile`	Basic profile information
`email`	Email address
`courses:read`	Read access to courses
`courses:write`	Write access to courses
`students:read`	Read access to students
`students:write`	Write access to students
`members:read`	Read access to members
`members:write`	Write access to members
`analytics:read`	Read access to analytics
`curriculum:read`	Read access to curriculum
`curriculum:write`	Write access to curriculum
`orders:read`	Read access to orders
`school:read`	Read access to school
`school:write`	Write access to school
`appearance:read`	Read access to appearance
`appearance:write`	Write access to appearance
`events:read`	Read access to events
`events:write`	Write access to events
`membership_plans:read`	Read access to membership plans
`membership_plans:write`	Write access to membership plans
`coupons:read`	Read access to coupons
`coupons:write`	Write access to coupons
`posts:read`	Read access to posts
`posts:write`	Write access to posts
`subscriptions:read`	Read access to subscriptions
`subscriptions:write`	Write access to subscriptions
`digital_products:read`	Read access to digital products
`digital_products:write`	Write access to digital products
`comments:read`	Read access to comments
`lecturers:read`	Read access to lecturers
`lecturers:write`	Write access to lecturers
`storage:write`	Write access to storage
`forms:read`	Read access to forms
`pages:read`	Read access to pages
`pages:write`	Write access to pages
`account:read`	Read access to account
`account:write`	Write access to account

Command-line interface

The loopwise CLI (on npm) deploys Loopwise Pages and reads this API from your terminal, using the same OAuth flow as above.

npm install -g loopwise
loopwise auth login --school YOUR_SUBDOMAIN
loopwise pages push ./dist --page homepage

Machine-readable resources

/openapi.json — OpenAPI 3.0 specification for this origin
/auth.md — The authentication walkthrough above, as Markdown
/llms.txt — Index of this site’s content for AI agents
/pricing.md — What this site sells, as Markdown
/mcp — MCP server (Streamable HTTP) for anonymous catalog reads
/.well-known/oauth-protected-resource — Protected Resource Metadata (RFC 9728)
/.well-known/oauth-authorization-server — Authorization Server Metadata (RFC 8414)
/.well-known/openid-configuration — OpenID Connect discovery document

Platform-wide documentation lives at https://docs.loopwise.com. Everything above is specific to https://monsterstack.kaik.io.