# API and Developer Docs: MCP Server and OAuth | Sidekick Pro

> Developer documentation for Sidekick Pro: the Sidekick Pro MCP server, OAuth 2.1 authorization, the OpenAPI description, Markdown content negotiation, and llms.txt.

*Source: [https://sidekickpro.com/developers](https://sidekickpro.com/developers)*

## The Sidekick Pro MCP server

Sidekick Pro speaks the Model Context Protocol. Point any MCP client at the endpoint below and it will discover two tools. `messageSidekick` takes a natural-language message for the user's assistant and returns the assistant's reply. When a request outlives the call, the reply carries a `checkId`, and calling `messageSidekick` again with only that `checkId` collects the finished answer. To add a CSV file to one of the user's Tables, an agent asks for an upload link, sends the file to it from its code environment, and asks for the import, so the file is transferred and never written into a tool call. `showSidekickView` shows the user's Sidekick Pro inbox inside the chat, as an MCP Apps view in clients that support them and as text elsewhere.

|  |  |
| --- | --- |
| Endpoint | POST https://sidekickpro.com/mcp |
| Transport | Streamable HTTP |
| Tools | messageSidekick({ message: string } \| { checkId: string }), showSidekickView({ view: 'inbox' }) |
| Auth | OAuth 2.1 bearer token, or a signed-in Sidekick Pro session cookie |

The assistant behind that tool has the user's email, calendar, tasks, documents, contacts, phone and SMS, memory, and connected apps, and an authorized connection can reach all of it. See [Authorization](#authorization) before you store a token.

## Authorization

Authorization is OAuth 2.1: authorization code flow with PKCE (S256) and RFC 7591 dynamic client registration, so a client can register itself with no manual onboarding. Discovery starts at [/.well-known/oauth-protected-resource](https://sidekickpro.com/.well-known/oauth-protected-resource).

**Authorization is all-or-nothing today.** The server issues one scope, `mcp:tools`, and there is no narrower one to request. A token for this server reaches the assistant with every tool enabled, so treat it as equivalent to the user's own access and store it accordingly.

| Scope | Grants | Withholds |
| --- | --- | --- |
| mcp:tools | Full assistant access. Sidekick may use every tool it has and act on the user's behalf: email, calendar, phone, SMS, documents, browser control, and connected apps. | Nothing beyond what the signed-in user can already do themselves. |

The user sees which client is asking, and what it will be able to do, on a consent screen before approving. The token response states the scope granted.

```
# Discover the authorization server
curl -s https://sidekickpro.com/.well-known/oauth-protected-resource

# Register a client
curl -s -X POST https://sidekickpro.com/mcp/oauth/register \
  -H 'Content-Type: application/json' \
  -d '{"client_name":"My Agent","redirect_uris":["https://example.com/callback"]}'

# Send the user to authorize
https://sidekickpro.com/mcp/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256
```

## Markdown for agents

Every page on this site has a Markdown twin, generated from the page itself at build time so it never drifts. Two ways to get it:

```
# Content negotiation on the same URL
curl -sH 'Accept: text/markdown' https://sidekickpro.com/teams

# Or the explicit .md twin
curl -s https://sidekickpro.com/teams.md
```

Negotiated responses carry `Vary: Accept, Accept-Encoding`, so a cache never hands the HTML variant to a client that asked for Markdown. HTML responses also advertise the twin with a `Link: </teams.md>; rel="alternate"; type="text/markdown"` header. A request that accepts neither type gets `406` rather than a silent fallback.

## Unknown URLs

A path that does not exist returns a real `HTTP 404`, never a 200 with an app shell. Clients that ask for Markdown, and clients that name no media type at all, get a short Markdown body that links this page, `llms.txt`, and the sitemap, so an agent can recover from a wrong guess in one more request.

```
curl -s -o /dev/null -w '%{http_code}\n' https://sidekickpro.com/no-such-page
# 404

curl -sH 'Accept: text/markdown' https://sidekickpro.com/no-such-page
```

## Machine-readable files

-   [`openapi.json`](https://sidekickpro.com/openapi.json) OpenAPI 3.1 description of the Sidekick Pro API, including the OAuth security scheme and what its scope permits.
-   [`.well-known/oauth-protected-resource`](https://sidekickpro.com/.well-known/oauth-protected-resource) RFC 9728 protected resource metadata. Start MCP discovery here.
-   [`.well-known/oauth-authorization-server`](https://sidekickpro.com/.well-known/oauth-authorization-server) RFC 8414 authorization server metadata: endpoints, grants, and scopes\_supported.
-   [`llms.txt`](https://sidekickpro.com/llms.txt) Curated index of every page, linking the Markdown twin of each.
-   [`llms-full.txt`](https://sidekickpro.com/llms-full.txt) The whole site as one Markdown document.
-   [`sitemap-index.xml`](https://sidekickpro.com/sitemap-index.xml) XML sitemap for crawlers.
-   [`robots.txt`](https://sidekickpro.com/robots.txt) Crawl policy. Everything public is allowed.

## Questions

Does Sidekick Pro have an MCP server?

Yes. The Sidekick Pro MCP server is at https://sidekickpro.com/mcp over the Streamable HTTP transport. It exposes two tools: messageSidekick sends a natural-language message to your assistant and returns its reply, and called with a checkId it collects the answer of a long request; showSidekickView shows the user's Sidekick Pro inbox inside the chat as an MCP Apps view.

How do I authenticate against the Sidekick Pro API?

With OAuth 2.1: authorization code flow, PKCE (S256), and RFC 7591 dynamic client registration. Discovery starts at https://sidekickpro.com/.well-known/oauth-protected-resource.

What OAuth scopes does Sidekick Pro support?

One: mcp:tools. It grants an agent the same assistant access the signed-in user has. There is currently no narrower scope, so treat a Sidekick Pro token as equivalent to the user’s own access.

Where is the Sidekick Pro OpenAPI spec?

At https://sidekickpro.com/openapi.json. It is OpenAPI 3.1 and declares the OAuth 2.1 security scheme and what its scope permits.

Can I read Sidekick Pro pages as Markdown?

Yes. Send Accept: text/markdown to any marketing URL, or append .md to it. https://sidekickpro.com/llms.txt indexes every page and https://sidekickpro.com/llms-full.txt is the whole site as one Markdown file.