# AppRefer > AppRefer is one SDK and one dashboard for attribution, subscriptions (AppRefer Billing), in-app support and analytics on iOS, Android, Flutter and React Native. Tracking links record the ad click, the SDK matches the install to it, AppRefer Billing (or RevenueCat webhooks) records purchases, and conversions are sent back to the ad network that drove them. Support (in-app chat, email, help centre, AI answers) and analytics use the same customer record. ## For AI agents Read https://apprefer.com/auth.md for the complete agent access contract. ## Let your agent sign up POST /api/agent/workspaces (public, JSON): { "email": "owner@example.com", "company": "Example Labs", "appName": "Example App", "agent": "Your agent" } email and company are required. appName and agent are optional. Returns 201: { "workspace_id": "org_…", "api_key": "ak_live_…", "claim_url": "https://apprefer.com/activate?code=XXXX-XXXX", "user_code": "XXXX-XXXX", "expires_at": "", "mcp_url": "https://apprefer.com/api/mcp", "test_mode": true } Save api_key securely on the server; it is returned once, hashed at rest, scoped to this organization and expires after seven days even after claim. Never put it in an app, browser bundle or log. Despite its ak_live_ prefix, it can only set up in test mode until the human claims and live access opens. Use pk_test_ SDK keys. GET /api/agent/workspaces/{workspace_id} with Authorization: Bearer returns { "status": "unclaimed" | "claimed_pending_approval" | "live" | "expired" }. The expired key can only read this status until cleanup removes it; it cannot operate on the workspace. Give claim_url and user_code to the human. They sign in with the matching verified Google email, review the apps built, then claim ownership or choose “This wasn't me” to delete the workspace. Claim joins the waitlist; live mode opens on approval, or immediately when signup is open. The agent can keep configuring sandbox data meanwhile. Unclaimed workspaces are removed after seven days. One open workspace per email; three creations per IP per day; up to three apps, twenty links and fifty products while unclaimed. Validation errors are 400 invalid_request, email conflict 409 workspace_exists, rate limit 429 rate_limited, storage failure 503 unavailable. Test mode permits apps, sandbox SDK data, tracking links, billing catalog (products, entitlements, offerings, placements, targeting, experiments), sandbox analytics and help articles. Ad integrations and store credentials, live SDK access, Support AI/delivery settings, web events, web purchases and erasure are refused. Signed Apple sandbox receipts can be verified without store credentials once the app bundleId is set through update_app; production receipts with pk_test_ are rejected. Google Play receipt verification still requires store credentials after claim and approval. Xcode-local purchases unlock on-device only under the existing SDK behavior. Team invitations and seats require claim. No platform admin key is given to a customer. The existing POST /api/agent/access-requests flow below remains an alternative for requesting account access without creating a workspace. It never issues credentials. ## Connect over MCP (OAuth) POST https://apprefer.com/api/mcp accepts organization API keys and OAuth access tokens, alongside operator admin keys. Use Authorization: Bearer . GET returns 405; each POST is stateless JSON-RPC. tools/list shows only tools allowed by the credential. The company always comes from that credential: omit orgId; appId/linkId must belong to it. Platform tools (list_orgs, cross-company portfolio, waitlist administration) are unavailable to customer agents. A 401 includes WWW-Authenticate: Bearer resource_metadata="https://apprefer.com/.well-known/oauth-protected-resource/api/mcp". Protected-resource metadata is also at /.well-known/oauth-protected-resource; authorization-server metadata is /.well-known/oauth-authorization-server. resource must be https://apprefer.com/api/mcp at authorization and token exchange. Use HTTPS Client ID Metadata Documents (client_id, client_name, redirect_uris, token_endpoint_auth_method: none); public DNS, bounded fetch and no redirects are enforced. POST /api/oauth/register is the per-IP rate-limited public-client fallback with client_name and redirect_uris (HTTPS or exact localhost loopback callback); no client secret is issued. Open /oauth/authorize with client_id, response_type=code, redirect_uri (exact registered value), scope (space-separated), code_challenge, code_challenge_method=S256, resource, and state. The human signs in, picks a company they belong to and allows or cancels. Claim a trial workspace first to make it selectable. The response includes iss and state. POST form-encoded /api/oauth/token with grant_type=authorization_code, code, client_id, redirect_uri, code_verifier, resource. Codes expire in ten minutes and work once. Access tokens are opaque, expire after one hour and are audience-bound to MCP. Refresh: grant_type=refresh_token, refresh_token, client_id, resource. Replace the refresh token every time; replay revokes the entire connection. Connections have a maximum thirty-day lifetime. Reconnect after that. POST /api/oauth/revoke with token and client_id, or use Settings → Connected agents to revoke immediately. Removing membership or write privileges also ends token authority. Tokens are hashed at rest. Scopes: apps:read (info, get_org, list_apps, get_app, readiness), apps:write (create/update apps); links:read/write; integrations:read/write; analytics:read (stats, overview, campaigns, events, attributions); skan:read; billing:read (catalog, subscription metrics, experiments), billing:write (catalog changes); support:agent (list/upsert/publish help articles). Viewer/member OAuth connections may request read scopes only. Trials remain test-only regardless of credential scopes. Risky customer MCP tools (delete_link, erase_user, update_billing_config, integration changes, Support AI auto) return { "approval_required": true, "approval_url": "https://apprefer.com/approve/" } inside result.content[0].text. A signed-in company admin approves the exact action; then repeat the same tool and arguments with approval_id set to the final URL segment. Approval expires after 24 hours, is bound to this credential and action and works once. Changing arguments or retrying a consumed approval fails. erase_user requires users:erase, appId, appUserId, requestId and explicit environment (all|live|sandbox); update_billing_config requires integrations:write, appId and config (same shape as REST billing config). Both require a human approval. Trial erasure and store configuration are refused. ## Rules for agents - SDK keys (pk_live_..., pk_test_...) are public and go in the app. Organisation API keys (ak_live_...) are server-side secrets: never put one in an app or a web page. - Use pk_test_ in debug builds and pk_live_ in release builds. Test-key data is sandbox data and is never forwarded to ad networks. - Server-side work (apps, tracking links, integrations, billing configuration, readiness checks) uses the REST API at https://apprefer.com/api/v1 with "Authorization: Bearer ". On a self-hosted AppRefer, use your own domain everywhere https://apprefer.com appears. - MCP (/api/mcp) accepts scoped organization keys or OAuth; the platform admin key is for operators only. - Don't track purchases with trackEvent when AppRefer Billing or RevenueCat is connected: purchases come from the store side. ## Docs Every docs page as markdown. Add .md to any docs URL, or request the page with `Accept: text/markdown`, to get the same content without the site around it. ### Get started - [Introduction](https://apprefer.com/docs.md): What AppRefer does and where to start. - [Quickstart](https://apprefer.com/docs/quickstart.md): Install the SDK and see your first install in minutes. - [How AppRefer works](https://apprefer.com/docs/overview.md): The journey from ad click to paying customer, and the architecture. - [AI agents & MCP](https://apprefer.com/docs/mcp.md): Let your coding agent set up and run AppRefer over MCP and llms.txt. - [Dashboard](https://apprefer.com/docs/dashboard.md): A tour of the dashboard: business, apps, acquisition, revenue, customers. ### SDKs - [iOS (Swift)](https://apprefer.com/docs/sdk/ios.md): Swift Package for native iOS apps. - [Android (Kotlin)](https://apprefer.com/docs/sdk/android.md): Kotlin library for native Android apps. - [Flutter](https://apprefer.com/docs/sdk/flutter.md): Dart package for Flutter apps on iOS and Android. - [React Native](https://apprefer.com/docs/sdk/react-native.md): TypeScript package for React Native and Expo apps. ### Attribution - [How attribution works](https://apprefer.com/docs/attribution.md): Click IDs, install matching, consent and what you get back. - [Tracking links](https://apprefer.com/docs/tracking-links.md): Links for each campaign, landing pages and store destinations. - [Events](https://apprefer.com/docs/events.md): In-app events, revenue and what gets sent to ad networks. - [Qualified trials](https://apprefer.com/docs/qualified-trials.md): Send only trials that are likely to pay. - [Qualified purchases](https://apprefer.com/docs/qualified-purchases.md): See which paid purchases stick (observe only). ### Billing - [Billing setup](https://apprefer.com/docs/billing.md): App Store, Google Play and Stripe subscriptions in one customer record. - [Offerings & experiments](https://apprefer.com/docs/offerings.md): Products, offerings, placements, targeting and paywall A/B tests. - [Subscription analytics](https://apprefer.com/docs/subscriptions.md): MRR, churn, trial conversion and revenue definitions. ### Support - [Customer support](https://apprefer.com/docs/support.md): In-app chat, email, help centre and AI answers. ### Integrations - [All integrations](https://apprefer.com/docs/integrations.md): Every ad network and service AppRefer connects to. - [Meta Ads](https://apprefer.com/docs/integrations/meta.md): Conversions API, datasets and cost sync for Facebook and Instagram. - [Google Ads](https://apprefer.com/docs/integrations/google.md): gclid, Data Manager API conversions and cost sync. - [TikTok Ads](https://apprefer.com/docs/integrations/tiktok.md): ttclid, Events API and cost sync. - [Apple Ads](https://apprefer.com/docs/integrations/apple-ads.md): Apple Search Ads attribution and cost sync. - [ChatGPT Ads](https://apprefer.com/docs/integrations/openai.md): oppref, Conversions API and reporting for ChatGPT Ads. - [X Ads](https://apprefer.com/docs/integrations/x.md): Web conversions for X (Twitter) ads. - [SKAdNetwork](https://apprefer.com/docs/integrations/skan.md): SKAdNetwork and AdAttributionKit postbacks and conversion values. - [RevenueCat](https://apprefer.com/docs/integrations/revenuecat.md): Use RevenueCat webhooks, or move to AppRefer Billing. ### Reference - [REST API](https://apprefer.com/docs/api.md): Every endpoint for your backend, with scoped keys. - [Privacy & data](https://apprefer.com/docs/privacy.md): Consent, hashing, retention and account deletion. ## Comparisons - [AppRefer vs RevenueCat](https://apprefer.com/revenuecat-alternative): Written by the AppRefer team: where each wins, with RevenueCat's own pricing cited. - [AppRefer vs AppsFlyer](https://apprefer.com/appsflyer-alternative): Written by the AppRefer team: where each wins, with AppsFlyer's own pricing cited. ## Optional - [All of the docs in one file](https://apprefer.com/llms-full.txt): every page above in one plain-text document, for agents that can read about 210,000 characters at once. - [Agent access contract](https://apprefer.com/auth.md): the exact sign-up, claim and approval requests for AI agents.