Start in your agent

Set up access once, then create and manage work through MCP or HTTP.

Set up your workspace once

Create an account, verify your email, choose the workspace and complete the available billing setup. Paid generation requires an active plan and available credits; internally funded workspaces are separate.
In Account → Security, create an API key for your integration. Save it privately when shown; choose the necessary scopes and an expiry. Alternatively, connect a compatible OAuth client and review its workspace and scopes in the browser.
Configure your agent with this deployment’s MCP endpoint, or use the versioned HTTP API. Call identity_get first and verify the returned workspaceId.
Submit the requested work directly. No task credit quote or maximum is required. Read progress and usage through the same integration.

Account recovery, MFA, member administration and payment changes retain browser-session and recent-auth requirements. Day-to-day design, page, site, blog, publishing, domain and form work uses the API or MCP. Your agent’s own tool-confirmation settings still apply.

Client setup recipes

Exact installed operations and scopes

Use the same operation through each interface

REST uses /api/v1. The operation name is the MCP tool name and the downloadable client’s call name. In MCP/client inputs, params identifies path values, query holds query parameters, body is the JSON body and idempotencyKey becomes the REST Idempotency-Key header. UUIDs, hashes and keys below are examples, not real resources: replace IDs and hashes with values returned by your own workspace, and persist a fresh key for each distinct action. Keep a key unchanged only when recovering that same uncertain action.

generation_create · MCP / client input

{
  "body": {
    "prompt": "Create a homepage for my bicycle repair workshop. Visitors should request an appointment. Use only the business facts I provide."
  },
  "idempotencyKey": "example-create-page-001"
}

curl --fail-with-body --max-time 30 \
  --header "Authorization: Bearer $WAVEFORM_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: $WAVEFORM_REQUEST_KEY" \
  --data-binary @brief.json "$WAVEFORM_ORIGIN/api/v1/generations"

brief.json contains only the body object, such as {"prompt":"your detailed brief"}. Generate and persist WAVEFORM_REQUEST_KEY before sending. A UUID works for all keyed operations. Do not add curl retry or redirect-following flags to a mutation. Read the saved job after a timeout; recover only that identical request with its original key.

Complete JavaScript, Python and curl examples

Choose permissions for the work

pages:read reads designs, source, quality, history and downloads.
pages:write creates and revises designs/pages/sites and authored post drafts.
pages:publish packages and publishes site releases, publishes checked pages, and unpublishes.
billing:read reads balance, reservations and customer usage receipts.
domains:manage connects, checks and disconnects custom domains.
forms:manage configures forms; leads:read reads submissions; leads:deliver sends explicit tests or requests delivery retries.

The credential’s saved workspace and your current membership constrain every request. A role change or revocation can invalidate access immediately. Never put a key in a URL, generated page, shared prompt or source repository. An OpenAI or other model-provider key is not a Waveform credential. GET /api/v1 returns the operations available to the current principal. Optional services appear only when installed.

Read this guide as Markdown Contact support