PassFast/Docs

MCP Server

Remote HTTPS Model Context Protocol endpoint. Agents (Cursor, Claude, Codex, and others) can call the full PassFast public API using tools named after OpenAPI operationIds. Markdown: /mcp.md.

Endpoint

Streamable HTTP at https://passfa.st/mcp (alias https://passfa.st/api/mcp). This is not a second API — every tool proxies one documented operation on https://api.passfa.st/functions/v1. Spec: openapi.yaml.

Authentication

Same as other remote MCPs: paste a PassFast secret key once in the client config. Tools work immediately. There is no OAuth dance, no PassFast “agent account,” and no chat UI — the agent is the MCP client (Cursor / Claude / ChatGPT / Codex / Grok). Create a key on the API Keys page after signup.

MCP connection headers

Authorization: Bearer sk_live_YOUR_SECRET_KEY
X-App-Id: YOUR_APP_ID

Secret key (sk_live_) — default MCP access. Full key-auth API surface.
X-App-Id — required when the org has multiple apps; optional for single-app orgs. You can also pass x_app_id on a single tool call.
Secret key only — this server rejects pk_live_. The key stays in the client config; it is never logged or echoed.

Cursor

Add to ~/.cursor/mcp.json (or project .cursor/mcp.json):

Cursor mcp.json

{
  "mcpServers": {
    "passfast": {
      "url": "https://passfa.st/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_YOUR_SECRET_KEY",
        "X-App-Id": "YOUR_APP_ID"
      }
    }
  }
}

Claude

Claude-compatible clients that speak Streamable HTTP:

Claude MCP HTTP config

{
  "mcpServers": {
    "passfast": {
      "type": "http",
      "url": "https://passfa.st/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_YOUR_SECRET_KEY",
        "X-App-Id": "YOUR_APP_ID"
      }
    }
  }
}

Stdio-only clients (Claude Desktop) can proxy with mcp-remote:

mcp-remote (stdio clients)

{
  "mcpServers": {
    "passfast": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://passfa.st/mcp",
        "--header",
        "Authorization: Bearer sk_live_YOUR_SECRET_KEY"
      ]
    }
  }
}

ChatGPT

Custom GPT / connector with Streamable HTTP. URL https://passfa.st/mcp, header Authorization: Bearer sk_live_YOUR_SECRET_KEY. Same paste-once secret as Cursor — no OAuth.

ChatGPT HTTP MCP config

{
  "mcpServers": {
    "passfast": {
      "type": "http",
      "url": "https://passfa.st/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_YOUR_SECRET_KEY",
        "X-App-Id": "YOUR_APP_ID"
      }
    }
  }
}

Tool groups (key-auth)

Tool names are the OpenAPI operationIds. Nothing else is invented.

Group	operationIds
Passes	generatePass, listPasses, getPass, updatePass, downloadPass, voidPass, getPassBySerial, updatePassBySerial, downloadPassBySerial, voidPassBySerial
Templates	createTemplate, listTemplates, getTemplate, updateTemplate, deleteTemplate, publishTemplate
Images	uploadImage, listImages, deleteImage, getImageUsage
Apple	uploadP12Certificate, uploadCertificate, listCertificates, deleteCertificate, testAppleCertificates
Google	uploadGoogleCredentials, listGoogleCredentials, deactivateGoogleCredential, testGoogleConnection
Org / apps	getOrganization, updateOrganization, getApp, createApp, updateApp, deleteApp, getManagedSigningStatus
Webhooks	testWebhook, listWebhookEvents
API keys	listApiKeys, createApiKey, revokeApiKey, deleteApiKey
Share	createShareToken, getSharePassMetadata, downloadSharedPass

Out of scope for v1 — members / invites (JWT)

These OpenAPI operations authenticate with a Supabase user JWT, not an API key. Key-auth MCP v1 does not expose them. Use the dashboard Members page or call the HTTP API with a session JWT.

listMembers, inviteMember, acceptInvitation, updateMemberRole, removeMember, listInvitations, revokeInvitation

Billing and rate limits

MCP does not add spend. generatePass and other writes hit the live API: first 100 generates free once, then $0.015 per active pass / month. Expired passes bill until voided or deleted. API 429 / 402 errors are returned as tool errors with the API body.

Typical agent flow

listTemplates — find a published template
generatePass — wallet_type: "both"
getPass / downloadPass
createShareToken — public link + QR