AI-assisted setup

Let Claude Code, Cursor or VS Code integrate Flow Affiliate for you: Flow’s MCP endpoint gives your coding assistant your program’s setup, the integration code with your app’s own ids, test events and what Flow has received, and, if you allow it, lets it fill in your setup. Its key works only in the test environment.

Your coding assistant can do the integration: install the SDK in your app, add the sign-up confirmation to your server, send a test sign-up and check that it arrived. If you let it, it also fills in your setup in Flow with what it finds in your project, such as the bundle ID from app.json and your store links. It talks to Flow Affiliate over MCP (Model Context Protocol), with a key that belongs to one program and works only in the test environment. The manual steps in the dashboard stay exactly the same; the assistant follows them with your program’s own values.

Create an AI key
In the dashboard, open your program, step 1 Install the SDK. Under Let your AI assistant do it, choose Connect your assistant, choose what the assistant may change (below), then Create AI key. The key starts with fg_ai_ and is shown once. Keep it in your environment as FLOW_AI_KEY, never in your code or in git.
```
export FLOW_AI_KEY=fg_ai_...
```

Add Flow to your assistant

Claude Code, with the Flow Affiliate plugin. It adds Flow's tools and two skills: integrate-flow-affiliate and add-app-clip.

claude plugin marketplace add Ebuno-AB/flow-group-mcps
claude plugin install flow-affiliate@flow-group

Or only the tools:

claude mcp add --transport http flow-affiliate https://api.affiliate.yflow.io/v1/mcp \
  --header "Authorization: Bearer $FLOW_AI_KEY"

Cursor, in .cursor/mcp.json:

{
  "mcpServers": {
    "flow-affiliate": {
      "url": "https://api.affiliate.yflow.io/v1/mcp",
      "headers": { "Authorization": "Bearer ${env:FLOW_AI_KEY}" }
    }
  }
}

VS Code, in .vscode/mcp.json. VS Code asks for the key the first time and keeps it to itself:

{
  "inputs": [{ "type": "promptString", "id": "flow-ai-key", "description": "Flow AI key (fg_ai_…)", "password": true }],
  "servers": {
    "flow-affiliate": {
      "type": "http",
      "url": "https://api.affiliate.yflow.io/v1/mcp",
      "headers": { "Authorization": "Bearer ${input:flow-ai-key}" }
    }
  }
}

Claude Desktop and other clients that only start local servers can reach it through mcp-remote:

{
  "mcpServers": {
    "flow-affiliate": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.affiliate.yflow.io/v1/mcp", "--header", "Authorization: Bearer ${FLOW_AI_KEY}"],
      "env": { "FLOW_AI_KEY": "fg_ai_..." }
    }
  }
}

Ask
Open your project and ask: Integrate Flow Affiliate into this app. With the Claude Code plugin you can also run /flow-affiliate:integrate-flow-affiliate. The assistant reads your setup, installs and wires the SDK, adds the user.registered confirmation with fg_click and fg_ref to your backend, sends a test sign-up, checks what arrived and ends with what is left for you in the dashboard: your store links, the payouts, the material and Send for review.

What the assistant may change

Every key can read the program's setup and send test events. When you create a key you choose what else it may change, and you can change that later in the key list:

Permission	What the assistant can change
Can change the setup (Får ändra uppsättningen), on by default	The app's store links, iOS app IDs (Team ID and bundle ID), Android package and signing fingerprints, where iPhones and Android phones go (with the App Clip bundle ID), the website fallback and your own link domain; the program's name, description, who may join, countries and attribution window; your app's own events; the app's logo, the company logo and material images.
Can change payouts and terms (Får ändra utbetalningar och villkor), off by default	Budgets, payout lines (a new line, a new version of one, or ending one) and the terms publishers accept.

It acts as you. Each change is made as the person who created the key, with the same checks as the dashboard, and never beyond what that person's role allows: a developer's key can change the app's links, logo and events, but not the payouts or the company logo. If that person leaves the team or loses the role, the key can only read and test.
It asks first. Claude Code asks you before each change. The assistant changes things only with values you gave it or that it read from your project (app.json or app.config, Info.plist, build.gradle, a store link you confirmed), never guesses a payout, and tells you what it changed.
Every change is logged under your name, marked as made through the key.
Never through an AI key: server keys (test or production), sending for review, going live or pausing, the team, publishers' applications, money to publishers, and deleting or archiving anything. Those stay in the dashboard.

Logos and material are uploaded with a one-time URL: upload_file answers a curl command that the assistant runs on the image in your project. The URL works once, for ten minutes, and the image gets the same checks as an upload in the dashboard. Material is saved as a draft that you turn on under Material.

The endpoint

POST https://api.affiliate.yflow.io/v1/mcp, Streamable HTTP, stateless: every request carries Authorization: Bearer fg_ai_… and gets a JSON answer. There is no session to keep and no server-sent stream, so GET and DELETE answer 405. Errors come back as JSON-RPC errors with an HTTP status: 401 for a missing, unknown or revoked key, 403 when the advertiser account is paused, 429 above 60 requests a minute per key. A change that Flow refuses (a wrong value, a missing role, more than 30 changes a minute) comes back as a tool error with the reason, and nothing is changed.

Tools

get_setupread

The program the key belongs to: app id, API and tracking URLs, the link setup, where iPhones and Android phones are sent (App Store, App Clip or your own deep link), the payout lines and terms, what the key may change, and the five setup steps with what is done, what is left and what is missing before review.

get_integration_guideread

Copy-paste code for expo_app, react_native_app, node_backend, other_backend (plain HTTP with the HMAC signature) or web, with your app id and URLs filled in. It is the same code the dashboard shows.

list_eventsread

The standard events (user.registered, purchase.completed, subscription.started and the reversals purchase.refunded and subscription.cancelled), your own events, what each payout line pays on them, and how many have arrived.

send_test_eventtest write

Sends one event in the test environment through the real pipeline and answers what Flow did with it: accepted, processed or ignored and why, attributed to which publisher, the test commissions it would earn, and whether it ticked step 2. Nothing in the test environment is ever paid.

check_statusread

What Flow has received: test and production sign-ups and how many were attributed, other events by type, the latest events, install matches from the SDK's first launch, requests refused for a wrong signature, and hints on what to fix.

app_clip_guideread

Whether the program uses an App Clip. Without one: when it helps, how to add one to an Expo app step by step, and where to enter its bundle ID in Flow. With one: what to check.

get_docsread

Any page of these docs as text, by its path, for example guides/links-into-your-app.

update_appsetup

Sets the store links, iOS app IDs, Android package and fingerprints, where each phone goes, the App Clip bundle ID, the website fallback and your own link domain. Only the fields it sends change; it answers what a publisher's link now does on each platform.

update_programsetup

The program's name, summary, description, who may join, countries and attribution window.

add_event, update_eventsetup

Your app's own events in the program's event catalog: name, description, kind, amount and fields. Standard events can't be changed.

upload_filesetup

A one-time upload URL and curl command for the app's logo (step 3 needs it), the company logo or a material image.

update_offerpayouts

Budget ceilings: in all, per day and per publisher.

add_payout_line, end_payout_linepayouts

A new payout line, a new version of one (the old version keeps what it already priced), or ending one. A live program keeps at least one line.

save_termspayouts

Replaces the terms: before approval the draft, after approval a new published version.

Security

Test environment only. The AI key reads your program's setup and sends test events, and changes only what you allowed (above), as the person who created it. It can't create keys, send the program for review, approve anything, touch production events or move money. Test events never reach the ledger.
One program. A key sees only the program it was created for.
Shown once, stored hashed. Flow keeps only a hash of the key. Lost it? Create a new one.
Revocable. Revoke a key in the program, under step 1 during setup or Tracking → Keys once live; assistants using it stop at once. A paused advertiser account pauses its keys too.
Your server keys stay with you. Your backend signs its events with its own test key (fg_test_…) from step 2; the assistant asks you for it and keeps it in your environment, never in the app.

Create an AI key#

Add Flow to your assistant#

Ask#

What the assistant may change#

The endpoint#

Tools#

Security#

Create an AI key

Add Flow to your assistant

Ask

What the assistant may change

The endpoint

Tools

Security