Developers
Build on Stoaken
A REST API, an MCP server for AI agents, signed webhooks and a CLI. They share one set of permissions: every call runs as a person, inside their role on each Brand, and every change goes through review.
01 · HTTP
REST API
Read Brands, token sets, themes and releases, save token documents, propose releases and deprecations. Create an API key under Settings → API keys and send it as a Bearer token.
- Pin the version with the
Stoaken-Version: 2026-09-29header. - Writes need an
Idempotency-Keyheader, so a retried request never applies twice. - Lists are paged with a cursor: pass back
next_cursoras returned. - Errors use the standard problem format (RFC 9457) with a stable type for each kind of problem.
- Limits: 120 requests a minute and 60 writes an hour per credential, reported in
RateLimit-*headers. - The full reference is an OpenAPI 3.1 document at
/api/openapi.json.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
-H "Stoaken-Version: 2026-09-29" \
https://stoaken.com/api/brands# Nothing is published: a person approves it.
curl -X POST -H "Authorization: Bearer $STOAKEN_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: release-2026-10-06" \
-d '{"version":"1.4.0"}' \
https://stoaken.com/api/themes/THEME_ID/releases| Method | Path |
|---|---|
| GET | /api/brands |
| GET | /api/brands/:brandId |
| GET | /api/brands/:brandId/token-sets |
| GET | /api/brands/:brandId/themes |
| POST | /api/brands/:brandId/themes |
| GET | /api/token-sets/:tokenSetId |
| PUT | /api/token-sets/:tokenSetId/document |
| PATCH | /api/token-sets/:tokenSetId/tokens |
| GET | /api/themes/:themeId |
| PATCH | /api/themes/:themeId |
| DELETE | /api/themes/:themeId |
| GET | /api/themes/:themeId/tokens |
| GET | /api/themes/:themeId/tokens/raw |
| GET | /api/themes/:themeId/deprecations |
| POST | /api/themes/:themeId/deprecations |
| GET | /api/themes/:themeId/releases |
| GET | /api/themes/:themeId/export |
| POST | /api/themes/:themeId/releases |
| GET | /api/releases/:releaseId |
| GET | /api/releases/:releaseId/snapshot |
| GET | /api/releases/:releaseId/export |
| POST | /api/releases/:releaseId/submit |
| GET | /api/brands/:brandId/webhooks |
| POST | /api/brands/:brandId/webhooks |
| PATCH | /api/webhooks/:webhookId |
| DELETE | /api/webhooks/:webhookId |
| POST | /api/webhooks/:webhookId/rotate-secret |
| POST | /api/webhooks/:webhookId/ping |
There is deliberately no endpoint to approve or publish. That happens in the Command Center, by a person.
Export tokens as code
Get a theme's live release as a file, ready to commit. The output has no timestamps, so a new export only shows up in a diff when the tokens changed. Pick a format with format:
cssCSS variablesA custom property for every token. Modes become attribute selectors, so one file covers them all.css-autoCSS, light and darkLight values in :root and dark values inside prefers-color-scheme: dark, so the page follows the device. data-theme="light" or "dark" on <html> overrides it.json-dtcgJSON (W3C)Resolved tokens in the W3C 2025.10 format, for Style Dictionary v5 and other current tools. One mode per file.json-sd4JSON (Style Dictionary v4)The same tokens with the older value format Style Dictionary v4 reads: hex colours, "16px", "200ms". One mode per file.jsJavaScriptAn ES module exporting a nested object of CSS-ready values. One mode per file.tsTypeScriptThe JavaScript module, typed with as const so values autocomplete. One mode per file.scssSCSSA Sass variable for every token, with CSS-ready values. One mode per file.tailwindTailwind configA tailwind.config.js theme.extend with colors, spacing, fonts, shadows and easing. Works with Tailwind 3, and Tailwind 4 through @config. One mode per file.tailwind4Tailwind 4 themeA CSS file with an @theme block (--color-*, --spacing-*, --font-*, --shadow-*, --ease-*, --radius-*) for Tailwind 4. Import it after "tailwindcss". One mode per file.swiftSwift (SwiftUI)A StoakenTokens enum with Color, CGFloat, Font.Weight and TimeInterval constants. One mode per file.composeJetpack ComposeA Kotlin StoakenTokens object with Color, Dp, FontWeight, TextStyle and easing values for Compose. One mode per file.androidAndroid XMLA values resource file with colors, dimens (dp), integers and strings. One mode per file, e.g. values/ and values-night/.
curl -H "Authorization: Bearer $STOAKEN_API_KEY" \
"https://stoaken.com/api/themes/THEME_ID/export?format=css&prefix=acme" \
-o tokens.cssCSS puts every mode in one file: the default under :root, the others as attribute selectors such as [data-color-scheme="dark"]. The other formats hold one mode per file; pass mode for a non-default one. To preview a release that's still waiting for review, export it by id: /api/releases/RELEASE_ID/export. Anything that can't be written faithfully (a gradient in CSS, for example) is left out and explained in the file's header, and counted in the Stoaken-Export-Warnings header.
02 · Model Context Protocol
AI agents (MCP)
Connect Claude or any client that speaks the Model Context Protocol to https://stoaken.com/mcp. Clients that support sign-in discovery connect with your Stoaken account; others can use an API key. The agent acts as you, with your role on each Brand.
list_brandsreadsThe Brands you can see, with your role on each.get_theme_tokensreadsA theme's tokens as stored.get_resolved_theme_tokensreadsTokens as a release would publish them, for any mode.list_deprecated_tokensreadsWhat is deprecated, its replacement, and what still uses it.list_releasesreadsA theme's releases, their status and what changed.export_tokensreadsA live release as CSS, SCSS, Tailwind, Swift, Android or JSON, ready to commit.list_webhooksreadsA Brand's webhooks, their health and latest deliveries.create_webhookproposesAdd a webhook (the secret is returned once).update_webhookproposesChange or re-enable a webhook.rotate_webhook_secretproposesNew signing secret; the old one signs for 24 hours.ping_webhookproposesSend a signed test event.create_themeproposesCreate a theme from token sets, optionally copying modes.update_themeproposesRename a theme or change its sets.delete_themeproposesDelete a theme that was never released.propose_token_changeproposesEdit a token set and submit it for review.propose_token_editsproposesSet, add, rename or delete tokens (or a whole group) and submit for review.propose_token_deprecationproposesDeprecate a token, reviewed like any other change.
Proposals become releases waiting for review, and write tools have their own rate limit so a runaway agent can’t flood your reviewers.
03 · Events
Webhooks
Brand Admins add endpoints under Settings → Webhooks. Stoaken sends a small JSON event when a release changes state:
release.pending_approvalrelease.publishedrelease.rejected
- Each request is signed following the Standard Webhooks spec (
webhook-id,webhook-timestamp,webhook-signature), so any of its libraries can verify it. - Failed deliveries are retried with increasing gaps for about a day.
- Events carry ids and status, not tokens. Fetch the details from the REST API with your own key.
04 · Terminal
CLI
One command signs you in, lets you pick a Brand, and sets up the project you run it in for MCP and API access.
npx stoaken init