# Quotae API documentation

Quotae is a mobile quoting and invoicing app for self-employed service professionals in Spain. Its supported agent integration uses an authenticated [MCP server](https://quotae.app/mcp/). This documentation describes that integration; the mobile app's internal REST endpoints are not a public developer API.

## Start here

1. Install Quotae from the [App Store](https://apps.apple.com/us/app/quotae/id6759922119) or [Google Play](https://play.google.com/store/apps/details?id=com.quotae.app), and sign in with your email verification code.
2. Create your business profile and a sample quote. [Quotes are free forever](https://quotae.app/pricing.md), with no card required. Product eligibility and operational limits still apply.
3. In a compatible Quotae build, open **Connected apps**. Continue in ChatGPT when the connection is available for your account. A ChatGPT account is required; its email can differ from your Quotae email.
4. Review the account, matching code and requested permissions in Quotae. Approve only the access you need, then return to the original browser to complete the connection.

The connector is a controlled rollout. The endpoint's presence and this documentation do not establish a publicly approved ChatGPT listing or access for every account. If the connection is unavailable, free quoting in the mobile app remains available.

## Machine-readable discovery

- [Quotae MCP API OpenAPI description](https://quotae.app/openapi.json)
- [OAuth protected-resource metadata and supported scopes](https://api.quotae.app/.well-known/oauth-protected-resource/mcp)
- [OAuth authorization-server metadata](https://api.quotae.app/.well-known/oauth-authorization-server)
- [Standard MCP endpoint configuration](https://quotae.app/mcp.json)
- [API documentation in Markdown](https://quotae.app/docs.md)
- [Agent resource index](https://quotae.app/llms.txt)

## Authentication and least privilege

The MCP API uses OAuth authorization code with PKCE S256, native owner approval, exact preregistered redirect URIs and an audience of `https://api.quotae.app/mcp`. Discover the authorization, token and revocation endpoints from the authorization-server metadata. Send access tokens in the `Authorization: Bearer` header. Never use a mobile session token as an MCP token.

| Scope | Permission |
| --- | --- |
| `account:read` | Read business setup, defaults and available actions |
| `clients:read` | Search saved clients and their available addresses |
| `catalog:read` | Search saved catalogue descriptions and prices |
| `quotes:read` | List and read quotes |
| `quotes:drafts:write` | Create or edit eligible unsent quote drafts and recover draft operations |
| `invoices:read` | List and read invoices and recorded payment facts |
| `reports:read` | Read authoritative reports and their contributing entries |

Request only the scopes required for the task. Draft writes also require account eligibility and enabled draft actions. There are no connector permissions to send quotes, issue invoices, record payments, delete documents or create clients. Review and send documents in Quotae.

Access tokens last up to 15 minutes. Refresh credentials rotate and expire 30 days after consent. Disconnect through **Connected apps** to revoke future access. Saved documents remain; information already returned to a conversation cannot be retracted.

## Testing and current onboarding limits

There is no public self-serve API-key dashboard, dynamic OAuth client registration, public sandbox or supported standalone Quotae SDK/CLI. OAuth access uses a preregistered client and explicit account approval. A free mobile account does not automatically grant connector access. Do not put production customer data into a test conversation.

For an already authorized client, follow the [MCP verification steps](https://quotae.app/mcp/#verify-an-authorized-connection). Integrators can check metadata without credentials; tool listing requires a valid MCP access token. Public API keys, developer registration and a separate sandbox need a future product decision.

## Operational limits

The connector allows up to 60 tool requests per minute per owner and 10 new draft writes per minute per owner, with separate IP controls. Requests and responses are bounded to 64 KiB. Use the original operation UUID when recovering an uncertain draft save. Keep currencies separate and preserve report amounts in integer cents.

See [current product terms](https://quotae.app/pricing.md), [privacy](https://quotae.app/en/privacy-policy/) and [terms of service](https://quotae.app/en/terms/). For support, email [use@quotae.app](mailto:use@quotae.app).