API & assistants

Everything the dashboard can do, the API and MCP can do. This page is for the person wiring that up — and for the machine reading /llms.txt.

Authentication

Create an API key in the app (API tab). Send it as a Bearer token:

curl https://golem.to/api/analytics/overview \
  -H "Authorization: Bearer golem_key_..."

Keys belong to the team, not a person; their authority is capped by the role of whoever minted them, and they can carry an expiry. Revoking a key disconnects whatever holds it — including assistants connected by OAuth, whose tokens are ordinary keys labelled “OAuth: …”.

Connect an AI assistant (MCP)

Golem speaks MCP at POST https://golem.to/mcp. In claude.ai or Claude Desktop, add a custom connector with that URL — Claude opens Golem's sign-in, you approve, done. From a terminal:

claude mcp add --transport http golem https://golem.to/mcp

Headless agents skip OAuth and send an API key: --header "Authorization: Bearer golem_key_...". The tool catalog covers links, forms, submissions, CSV export, translations, analytics, shared reports, and domains — ask an assistant to “make a June report for the podcast link and draft the renewal email” and it has every tool that sentence needs.

Machine-readable forms

Every form describes itself. Fetch https://golem.to/f/<slug> with Accept: application/json (or /f/<slug>/schema) for stable field keys, value types, and submit instructions; POST answers back as JSON. Send X-Golem-Agent: your-name so your traffic is classified as agent — never folded into the customer's human totals.

Shared reports

https://golem.to/r/<token> is a public funnel report — no account needed. Append .json for the machine twin: every rate ships with its numerator and denominator, and the methodology block states that bots are excluded and opens are requests, not people. Reports are minted from a form's Stats panel, the API, or the create_report tool, and revoking one kills the URL for everyone, immediately.

REST surface

The API uses the same nouns as the tools. The load-bearing endpoints:

POST /api/auth/magic-link        sign in (humans; emailed link)
GET  /api/links                  list · POST create
GET  /api/links/<id>/analytics   the link's funnel
GET  /api/forms                  list · POST create
GET  /api/forms/<id>/submissions responses · /submissions.csv export
GET  /api/analytics/overview     team roll-up (?days=&scope=all|links|forms)
GET  /api/analytics/sources      which link produced the most responses
POST /api/reports                mint a shareable report
GET  /api/domains                branded domains

Retiring is a transition, not a delete: POST /api/links/<id>/archive makes the URL answer 410 while keeping every recorded open; /restore undoes it.

Reading the numbers

Requests are classified filtered_open (human), agent, bot, preview, or scanner — totals count only the first. click_to_response divides responses attributed to a link by link opens that landed on a form; view_to_response divides responses by human form views. A zero denominator renders as “—”, because “0%” would claim a measurement that never happened.

Questions the page doesn't answer: the MCP tool descriptions themselves are the deepest reference — connect and list them.