Developer integrations

One core API and auth layer — REST for automation, webhooks for real-time triggers, MCP for AI agents. Account scope always comes from your API key, never from request parameters.

REST API v1

List contests, read stats, and export CSV. Built for Make.com, Zapier, and custom scripts.

https://app.rewardsfuel.com/api/v1

Bearer token auth (read scope)
Standard { ok, data, error } envelope
120 requests/min per key

Outbound webhooks

Push events to Make.com or Zapier when contests start, entries arrive, or winners are picked.

POST https://app.rewardsfuel.com/api/v1/webhooks

Seven event types (entrant, winner, contest lifecycle)
HMAC-signed deliveries (X-RF-Signature)
Optional per-contest filters

MCP for AI agents

Connect Cursor, Claude Desktop, or custom agents to contest data and exports.

https://app.rewardsfuel.com/api/mcp

JSON-RPC over HTTP (mcp scope)
Same core services as REST — no duplicate logic
Free draw_winners on public endpoint

Quick start

Subscribe to any paid plan.
Open Account → API keys & integrations and generate a key.
Choose your integration path: webhooks (real-time), REST (polling/export), or MCP (AI).

API key scopes

Scope	Used for
`read`	REST v1 contest reads and CSV export
`hooks`	Register and manage outbound webhooks
`mcp`	MCP server tool calls
`wp`	WordPress plugin API

New keys include all scopes by default. Revoke compromised keys immediately in Account settings.

Security

Tenant isolation is enforced from the validated API key — never pass account_id or user_id.
Contest access is checked per contestId against contests you own or collaborate on.
Webhook payloads are signed; verify X-RF-Signature before trusting automation flows.