Build on TradeSender

A program can reach a workspace in three ways. Each has its own address and its own way of proving who is asking.

Everything is served from https://app.tradesender.co.uk.

The API

The web, iPhone and Android apps are built on the same API you call. A member makes a key in Settings, then API keys, and the key works as that member, with their role.

curl "https://app.tradesender.co.uk/api/v1/customers" \
  -H "Authorization: Bearer $TRADESENDER_KEY"

• API keys: make one, what it can reach and what ends it.
• Requests and conventions: JSON, paging, money, times, retries and errors.
• Rate limits: how many requests a workspace's keys may send.
• Changes: what we promise not to break, and the change log.
• API reference: every operation, with its fields and an example.

The enquiry form

Each workspace has one public address that accepts an enquiry from a website. Anything may post to it, from a browser or a server.

• The enquiry form's address: the fields it takes and what it answers.
• The embed script: two lines that draw the form on a page.
• WordPress plugin reference: the shortcode and its settings.

AI assistants

Claude, ChatGPT, Codex and other apps that speak the Model Context Protocol connect at one address. The person approves the connection in their browser and the app then works as them.

• The MCP server: the endpoint, its tools and the protocol versions.
• OAuth sign-in for assistants: discovery, registration, the code and the token.

What is not there

• Webhooks. TradeSender does not call your server when something changes. Ask the API for what you need.
• Apps that act for many workspaces. There is no developer registration and no OAuth for the API. An API key belongs to one member of one workspace, and each workspace makes its own.
• Scopes. A key has its member's whole access to business records. It cannot be narrowed to reading, or to one kind of record.
• Calls from a web page. The API sends no CORS headers, so a browser on another site cannot call it. Call it from a server. The enquiry form's address is the one exception.
• Client libraries. There is no SDK. The API is plain JSON over HTTPS.