Connect Claude or Cursor (MCP)

Point Claude or Cursor at /api/mcp with a personal fcs_ key or OAuth 2.1 PKCE.

Who can do this: Studio admins, managers, and staff. Students cannot use MCP.

MCP URL

https://www.fitnessclass.studio/api/mcp

Every tool is scoped to the studio bound to your token. Tools call /api/v1/studio/* with the same Bearer token, so permissions match the staff UI. There are no charge, refund, or delete-class tools.

Option 1 — Personal API key

  1. Sign in as studio staff, open Settings → API keys, and create a named key. Copy the full fcs_… token (shown once). See Create and revoke API keys.
  2. In Claude or Cursor, add a custom MCP server:
    • URL: https://www.fitnessclass.studio/api/mcp
    • Header: Authorization: Bearer fcs_…
  3. After connecting, call ping, then a read tool such as classes_list. Reconnect the connector after we add tools.

Option 2 — OAuth

Leave the MCP auth header blank. The connector should:

  1. POST /api/mcp and receive 401 plus WWW-Authenticate resource_metadata.
  2. Read /.well-known/oauth-protected-resource (resource is the site origin plus /api/mcp).
  3. Register at /oauth/register, then complete PKCE S256 at /oauth/authorize (studio login) and /oauth/token.

OAuth does not reuse the browser’s Supabase refresh token. /oauth/authorize mints an independent session.

curl check

B=https://www.fitnessclass.studio
curl -s -X POST $B/api/mcp \
  -H "Authorization: Bearer fcs_…" \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Then call ping, then classes_list.

HTTP API

The same Bearer token works on /api/v1/studio/*. Open the API explorer for parameters and responses.

Gotchas

  • Storefront clients / students are denied.
  • Local-only env fallbacks (FCS_API_KEY, MCP_DEV_API_KEY) are ignored on Vercel.
  • Production already has the MCP OAuth + api_keys tables. Do not re-run the SQL unless you are standing up a new database.

Related articles