---
title: "Developers — Build with OXOM"
description: "Developer resources for OXOM: the OpenAPI 3.1 specification, the OXOM MCP server (Streamable HTTP), OAuth 2.0 agent authentication, agent cards and llms.txt."
canonical: https://oxom.de/developers
last-updated: 2026-10-10
---

# Developers — Build with OXOM

> Developer resources for OXOM: the OpenAPI 3.1 specification, the OXOM MCP server (Streamable HTTP), OAuth 2.0 agent authentication, agent cards and llms.txt.

Canonical HTML: https://oxom.de/developers
## MCP server
A Model Context Protocol server over Streamable HTTP with 10 tools. At consent, the user decides what the connection may reach: one workspace, or every workspace they belong to. Membership and role are re-checked on every call.

- Endpoint: https://mcp.oxom.de/mcp
- Transport: Streamable HTTP (not legacy SSE), protocol version 2025-06-18
- Auth: OAuth 2.0, authorization code + PKCE (S256)
- Client ID: `oxom-claude` (public client, no secret; dynamic registration is not implemented)
- Server card (no auth needed): https://oxom.de/.well-known/mcp/server-card.json
- Discovery without a token: `initialize`, `ping`, `tools/list`, `resources/list`, `resources/read` answer without a bearer token — only `tools/call` does not.

### Tools
- `list_workspaces` (read) — list the workspaces this connection can act on
- `list_links` (read) — short links with slug, destination, and click counts
- `create_link` (write) — create a short link from a destination URL and optional slug
- `search_docs` (read) — search Docs metadata (title, emoji)
- `create_doc` (write) — create a new, empty Doc
- `search_drive_files` (read) — search and list files in the R2-backed Drive
- `create_upload_link` (write) — mint a signed, expiring upload link
- `get_team_time` (read) — read the caller's own Team Time availability
- `set_stream_plan` (write) — attach a personal .ics calendar as the Stream Plan
- `list_streamelements_commands` (read) — the channel's StreamElements chat-bot commands

## Authentication (OAuth for agents)
OXOM uses the standard: OAuth 2.0 with authorization code and PKCE. The authorization server is app.oxom.de, the resource server is the MCP endpoint. There are no API keys.

- Full walkthrough: https://oxom.de/auth.md
- AS metadata (RFC 8414): https://app.oxom.de/.well-known/oauth-authorization-server
- Protected resource metadata (RFC 9728): https://mcp.oxom.de/.well-known/oauth-protected-resource
- Grant types: `authorization_code`, `refresh_token`

Scopes (request the narrowest set that covers the job): `links:read`, `links:write`, `docs:read`, `docs:write`, `drive:read`, `drive:write`, `workspace:read`.

## Public REST API
Deliberately small and unauthenticated: look up and complete pay links, check slugs and domains during onboarding, render OG images.

- OpenAPI 3.1 spec: https://oxom.de/openapi.json
- Versioning: date-based via the `OXOM-Version` header; deprecations are announced with `Deprecation` and `Sunset` response headers
- Idempotency: write operations accept an `Idempotency-Key` header
- Errors: JSON only, with a machine-readable `error.code` and a human-readable `error.message`
- Rate limits: `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, plus `Retry-After` on 429

Endpoints: `GET /api/onboard/check-slug`, `POST /api/onboard/check-domain`, `GET /api/pay/{key}`, `POST /api/pay/{key}/checkout`, `POST /api/pay/{key}/verify`, `POST /api/pay/{key}/gift`, `GET /api/og`.

## WebMCP
oxom.de also registers its public capabilities as in-page tools via `navigator.modelContext` (WebMCP, a W3C community draft). An agent running inside the visitor's browser can call them directly instead of driving the DOM — deliberately the unauthenticated surface only, with no credentials involved.

## Discovery documents
- A2A agent card: https://oxom.de/.well-known/agent-card.json
- MCP server manifest: https://oxom.de/.well-known/mcp.json
- Agent Skills index: https://oxom.de/.well-known/agent-skills/index.json
- Agent instructions: https://oxom.de/.well-known/agent-skills (also /.well-known/agent-skills/SKILL.md)
- AI resource catalog (ARD): https://oxom.de/.well-known/ai-catalog.json
- API catalog (RFC 9727): https://oxom.de/.well-known/api-catalog
- llms.txt: https://oxom.de/llms.txt (developer edition: https://oxom.de/developers/llms.txt)

## Support
Integration questions, or a redirect URI you need registered for your agent: support@oxom.de. Status: https://status.oxom.de

## Read more
- [Set up the MCP in Claude](https://oxom.de/docs/mcp)
- [Tools with parameters](https://oxom.de/docs/mcp/tools)
- [Agent authentication guide (auth.md)](https://oxom.de/auth.md)
- [OpenAPI specification](https://oxom.de/openapi.json)
- [Docs](https://oxom.de/docs)
- [GitHub](https://github.com/oxom-de)