API & MCP documentation

• Claude (Desktop, Web and Code): full MCP support with OAuth — the recommended way to use RSVPhere from a chat window.
• Cursor, Codex, Windsurf and other MCP clients: supported, add the same remote URL.
• ChatGPT: does not support the MCP protocol, but you can build a Custom GPT Action using the OpenAPI spec below. It authenticates with OAuth, so each user signs in with their own RSVPhere account, and ChatGPT can list events, read guest lists, and add invitees on their behalf.

Open Claude Desktop → Settings → Developer → Edit Config and add the rsvphere entry below to claude_desktop_config.json, then restart Claude. Keep any servers you already have in mcpServers.

{
  "mcpServers": {
    "rsvphere": {
      "url": "https://rsvphere.app/mcp"
    }
  }
}

On first use Claude opens a browser window on RSVPhere. Sign in with your host account and approve the connection on the consent screen. Then ask “list my events” to confirm it works.

If your Claude build only supports stdio servers, bridge to the HTTP endpoint instead:

{
  "mcpServers": {
    "rsvphere": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://rsvphere.app/mcp"]
    }
  }
}

Every MCP-capable client works the same way. Add a remote/HTTP MCP server, paste the URL above, and the client walks you through sign-in.

1. In your assistant, add a new connector or MCP server and choose the remote/HTTP type.
2. Paste https://rsvphere.app/mcp as the server URL.
3. A browser window opens on RSVPhere. Sign in with your host account and approve the connection on the consent screen.
4. The assistant lists the available tools. Try “list my events” to confirm the connection.

ChatGPT does not speak MCP, but it can call REST endpoints through a Custom GPT action. The action now uses OAuth, so each person who uses the GPT signs in with their own RSVPhere account instead of pasting a shared key.

1. In ChatGPT, create a new Custom GPT and open Configure → Add actions.
2. Choose Import from URL and paste https://rsvphere.app/api/public/openapi.json.
3. Set the authentication type to OAuth. ChatGPT pre-fills the authorization and token URLs from the spec:
   https://eskfjnwurmkciqdjdzdp.supabase.co/auth/v1/oauth/authorize
https://eskfjnwurmkciqdjdzdp.supabase.co/auth/v1/oauth/token
4. Register an OAuth client to get a client ID and secret, using the callback URL ChatGPT shows you after saving the action:

   curl -X POST https://eskfjnwurmkciqdjdzdp.supabase.co/auth/v1/oauth/clients/register \
     -H "Content-Type: application/json" \
     -d '{
       "client_name": "My RSVPhere GPT",
       "redirect_uris": ["<callback URL shown by ChatGPT>"],
       "grant_types": ["authorization_code", "refresh_token"],
       "response_types": ["code"],
       "token_endpoint_auth_method": "client_secret_post"
     }'

   Paste the returned client_id and client_secret into ChatGPT, set scope to openid email profile offline_access and token exchange method to POST.
5. Save, then click Sign in with RSVPhere in the GPT and approve the consent screen. You can now ask things like “List my events”, “Who is attending the gala?”, or “Add Jane Doe to the launch event.”

Access tokens are short-lived. Because the action requests offline_access, the client also receives a refresh token and renews access silently — you stay connected without signing in again. If a token does expire mid-call, the API replies 401 with WWW-Authenticate: Bearer error="invalid_token", which tells the client to refresh at https://eskfjnwurmkciqdjdzdp.supabase.co/auth/v1/oauth/token (grant type refresh_token) and retry.

Prefer a script or a headless integration? The same endpoints still accept an API key from your account settings via Authorization: Bearer <key>.

RSVPhere supports two authentication models, depending on how you connect.

• OAuth 2.1 (Claude, Cursor, ChatGPT actions): clients register (or self-register dynamically) and obtain a short-lived access token after you approve them on the consent screen. Every user of a shared GPT or connector signs in as themselves.
• API keys (scripts, servers): generate a key in your RSVPhere account settings and send Authorization: Bearer <your-api-key> with every request. Revoke keys at any time from the same page.

In both cases the caller acts as you: it can only touch events you own or co-host, and plan limits apply exactly as they do in the app. Revoke OAuth access by removing the connector in your assistant; revoke API keys from your RSVPhere account settings.

The MCP endpoint speaks JSON-RPC 2.0 over MCP Streamable HTTP. Requests must accept both JSON and SSE responses.

curl -X POST https://rsvphere.app/mcp \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "list_invitees",
      "arguments": { "event_id": "…", "rsvp_status": "pending", "limit": 50 }
    }
  }'

Use "method": "tools/list" to enumerate every tool with its JSON Schema. Tool results come back as MCP content blocks; read tools also return structured JSON where it is useful.

The REST API is simpler for code that doesn't speak MCP. Authenticate with an API key and use the endpoints described in the OpenAPI spec.

curl https://rsvphere.app/api/public/v1/events \
  -H "Authorization: Bearer $RSVPHERE_API_KEY"

curl https://rsvphere.app/api/public/v1/events/<event-id>/stats \
  -H "Authorization: Bearer $RSVPHERE_API_KEY"

curl -X POST https://rsvphere.app/api/public/v1/events/<event-id>/invitees \
  -H "Authorization: Bearer $RSVPHERE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Jane",
    "last_name": "Doe",
    "email": "jane@example.com"
  }'

29 tools across 7 groups. Parameters marked * are required. Tools tagged write change data; tools tagged Pro require a Pro plan.

• Tools that send email (send_reminder, invite_cohost) send real messages immediately — always confirm the audience before running them.
• Plan limits on events, invitees and Pro features are enforced server-side.
• Deletions (delete_invitee, delete_owner) are permanent.
• Keep calls bounded — use limit and filters on list_invitees for large guest lists.