What it does
Klipy exposes three open build surfaces: a REST API v2, Svix-managed webhooks, and an OAuth MCP server. There's no request-access gate on the surface itself, only on scale and controls.
The REST API v2 (base https://api.klipy.ai/api/v2) covers most of Klipy's CRM object model. Contacts, companies, deals, pipelines, tasks, notes, and segments are fully readable and writable. Interactions are readable and can be logged, create-only through the API, with no edit route. Meetings, recordings, and bookings are read-only, since they're sourced from calendar and call-recording integrations.
Webhooks, managed through an embedded Svix console, push lifecycle events to your endpoint in real time. Nine event types are live today, including lead.captured, deal.created, deal.moved, and booking.created (see webhook event types for the full list).
The MCP server exposes 38 tools gated across 9 OAuth capability scopes, so an external agent (Claude, ChatGPT, or any MCP client) can read, and with explicit approval, write the same records.
How it connects
Three self-serve paths, no sales conversation required.
API. Create a scoped key at Settings → API (app.klipy.ai/settings/api). Pick the exact resource:action scopes you need (there's no ALL scope), choose organization-wide or user-bound access, and copy the klipy_live_* secret shown once at creation. Authenticate every request with X-Klipy-Api-Key or Authorization: Bearer. Limits: 200 requests per minute per key, 1000 requests per minute per org, with optional Idempotency-Key support on POST and PATCH. Key rotation has a grace-window overlap; revocation returns a 401. See issuing API keys.
curl https://api.klipy.ai/api/v2/contacts \
-X POST \
-H "X-Klipy-Api-Key: <key>" \
-H "Idempotency-Key: 8f14e45f-ceea-4b0a-9127-1e2e3c3c1a1a" \
-H "Content-Type: application/json" \
-d '{"email": "person@example.com"}'Webhooks. Open Settings → Webhooks in the app, use the embedded Svix console to create an endpoint, and enable organization-level delivery. Verify the svix-id, svix-timestamp, and svix-signature headers on every payload, and return a 2xx only after you've persisted the event.
{
"type": "lead.captured",
"object": "event",
"data": {
"id": "h7w8y2f1",
"first_name": "Jordan",
"last_name": "Patel",
"email": "jordan.patel@acmeanalytics.com",
"title": "Head of Growth",
"company_name": "Acme Analytics",
"company_domain": "acmeanalytics.com",
"industry": "SaaS",
"employee_count": 350,
"estimated_revenue": 1200000,
"city": "Austin",
"state": "TX",
"country": "US",
"linkedin": "https://linkedin.com/jordan-patel"
}
}MCP. Point any OAuth-capable MCP client at https://api.klipy.ai/mcp. The first connection shows a consent screen with a checkbox per capability scope, and the agent can only call tools tied to scopes you approve. Outbound sends stay gated behind two explicit steps: prepare_message_send returns a single-use confirmation token, and send_message_draft only fires with that token and your approval. No agent dispatches a message on its own. See connecting other MCP clients.
No-code. Zapier and Make.com aren't bundled connectors either. Both call this same REST API on a trigger and receive these same webhooks as a trigger source, per Klipy's integrations FAQ. Wiring a Zap or a Make scenario is still a self-build against the mechanism above, just without writing the request yourself.