Public URLs

Most public APIANT URLs carry no password or API key: the long identifiers in the path are the credential. Anyone who has one of those URLs can use it, so share each one only with the system or person that needs it.

Hosts

Host	Serves
`https://app.apiant.ai`	Sign-in, the automation diagram, the assistant, hosted forms, chat widgets, approval links, the OAuth authorization server, the catalog feed
`https://mcp.apiant.ai`	The APIANT MCP server for Claude Code
`https://hooks.apiant.ai`	Inbound webhooks and web services

When your account's installation has a white-label domain, form trigger and chat widget URLs use that domain instead of app.apiant.ai. Forms sent during a run, approval links, webhook URLs and web service URLs stay on the APIANT hosts.

Identifiers in the URLs

Each URL below ends in a long random-looking key, shown here as {key}. Claude or the assistant gives you the finished URL when it builds or commits the automation. Use the URL exactly as issued: you cannot build one by hand, and a changed key does not work.

URL reference

URL	Shape	Who uses it	What protects it
Webhook trigger	`https://hooks.apiant.ai/automation-{key}`	An external system that sends events	The key. No sign-in, no API key.
Web service	`https://hooks.apiant.ai/webservice-{key}`	A caller that waits for the automation's HTTP response	The key. Counts against your monthly web service quota.
Hosted form (form trigger)	`https://app.apiant.ai/form/{key}`	Anyone you send the form to; every submission starts a run	The key, plus sign-in when the form requires it
Form sent during a run	`https://app.apiant.ai/form/s/{key}`	The one person asked to fill it in	A random key for this one request. Works once: the link stops working after submission.
Form session page	`https://app.apiant.ai/form/run/{key}`	The person following a run that shows forms one after another	A random session key. Stays valid for the whole run.
Chat widget page	`https://app.apiant.ai/webchat/{key}`	Visitors to the page or to the site it is embedded on	The key opens the page. Each conversation is bound to a token the server issues when the page loads.
Chat widget embed script	`https://app.apiant.ai/webchat/embed.js?key={key}`	Your website, in a `<script>` tag	Same as the chat widget page
Human approval link	`https://app.apiant.ai/moderation?queue={key}`	The approver named in the automation, who needs no APIANT account	A random key. It opens that automation's queue of pending items for the approver.
APIANT MCP server	`https://mcp.apiant.ai/mcp`	Claude Code	OAuth 2.1 sign-in with your APIANT account and the MCP Tools permission
Automation diagram	`https://app.apiant.ai/automation?uuid={automation ID}`	You	Sign-in. Signed-out visitors are redirected to `/login`.
Catalog feed	`https://app.apiant.ai/catalog/v1/apps`	Anyone	Public, read-only, rate-limited per IP

Webhook trigger URLs

A webhook URL starts a run on GET, POST and PUT. The request is accepted and queued, and the automation runs in the background; the sender does not wait for it. A HEAD request is answered without starting a run. Requests to the same URL with the /webhook/ prefix (https://hooks.apiant.ai/webhook/automation-...) reach the same automation.

See Webhook triggers.

Web service URLs

A web service URL runs the automation while the caller waits, and returns the response the automation sets. It sends CORS headers (Access-Control-Allow-Origin: *, no credentials) and answers OPTIONS preflight requests, so JavaScript on any website can call it. Errors the caller can receive:

Status	Meaning
`404`	`web service not found`
`429`	`monthly usage limit reached`
`503`	`web service is not active`: turn the automation on

See Web service automations.

Form and chat URLs

A form trigger URL and a chat widget URL stay the same across submissions and conversations. A form sent to someone during a run uses a one-time link instead. An already-used or wrong one-time link shows the same page ("This form is not available. It may already have been submitted, or the link may be incorrect."), so the page never reveals whether a link ever existed. See Hosted forms and Chat widgets.

MCP server and OAuth discovery

https://mcp.apiant.ai/mcp answers an unauthenticated request with 401 and a WWW-Authenticate header that points at its metadata. Claude Code reads two discovery documents:

bash

$ curl -s https://mcp.apiant.ai/.well-known/oauth-protected-resource
{"authorization_servers":["https://app.apiant.ai"],"resource":"https://mcp.apiant.ai"}

$ curl -s https://app.apiant.ai/.well-known/oauth-authorization-server

Authorization server metadata (captured 2026-09-15, formatted):

json

{
  "issuer": "https://app.apiant.ai",
  "authorization_endpoint": "https://app.apiant.ai/oauth/login",
  "token_endpoint": "https://app.apiant.ai/oauth/token",
  "registration_endpoint": "https://app.apiant.ai/oauth/client",
  "revocation_endpoint": "https://app.apiant.ai/oauth/revoke",
  "scopes_supported": ["mcp:tools", "mcp:automation_builder"],
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["client_secret_post"]
}

See Authentication and permissions.