Spext Developer Platform & REST API

Integrate secure, encrypted, and auto-expiring transfer infrastructure into your applications using our REST API, real-time Webhooks, and AI Model Context Protocol (MCP).

High-Throughput REST API

Programmatically create, read, and manage text, links, and file transfers with clean JSON payloads.

Real-Time Webhooks

Receive instant push notifications signed with HMAC SHA-256 when transfers are created, viewed, or expired.

Model Context Protocol (MCP)

Expose Spext capabilities natively to Claude Desktop, Cursor, and custom LLM agents.

SSP Cryptographic Envelope

PBKDF2 key derivation and AES-256 GCM encryption for zero-knowledge data transfers.

Atomic Burn-After-Reading

Guaranteed single-recipient access with atomic deletion upon first successful consumption.

Safe Idempotent Requests

Safely retry failed requests without accidental duplication using Idempotency-Key headers.

Quickstart Guide

Create your first encrypted ephemeral transfer in 3 simple steps.

curl -X POST https://spext.fun/api/v1/transfers \
  -H "Authorization: Bearer spx_sk_live_abc123" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "type": "text",
    "text": "Sensitive database configuration password",
    "expiration": "1h",
    "oneTime": true
  }'

Authentication & Scopes

All Spext REST API endpoints are protected using standard Bearer Token authentication.

Authorization

Granular Scopes

Following the principle of least privilege, grant only necessary scopes to each key:

SECURITY BEST PRACTICES

• Never expose secret keys in client-side code or commit them to public version control.
• Use environment variables (.env.local) to store secrets securely.
• Immediately revoke any key suspected of being compromised from Developer Settings.
• Always verify the X-Spext-Signature header for incoming webhook deliveries.

Test live endpoints, adjust payload fields, and inspect simulated server responses in real time.

API Reference (Endpoints)

REST documentation with schemas, parameters, payloads, and response structures.

Webhooks & Event Delivery

Receive real-time push events when transfers are created, accessed, or purged.

Cryptographic Signature Verification (HMAC SHA-256)

Every webhook request carries an X-Spext-Signature header. Verify the signature against your webhook secret to confirm the payload originated from Spext:

import crypto from 'crypto';

export function verifySpextWebhook(payloadString, signatureHeader, secretKey) {
  const [tPart, v1Part] = signatureHeader.split(',');
  const timestamp = tPart.split('=')[1];
  const signature = v1Part.split('=')[1];

  const signedPayload = `${timestamp}.${payloadString}`;
  const expectedSignature = crypto
    .createHmac('sha256', secretKey)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

Model Context Protocol (MCP) Server

Equip Claude Desktop, Cursor, LangChain, and autonomous agents with native Spext tools.

Claude Desktop Configuration (claude_desktop_config.json)

{
  "mcpServers": {
    "spext": {
      "command": "npx",
      "args": ["-y", "@spext/mcp-server"],
      "env": {
        "SPEXT_API_KEY": "spx_sk_live_your_key_here"
      }
    }
  }
}

Rate Limits, Error Codes & Idempotency

Specifications and protocols engineered for high reliability and throughput.

HTTP Status Codes

Developer Frequently Asked Questions

Technical guidance and answers for building on Spext.

Spext API ile Entegrasyona Hemen Başlayın

Geliştirici anahtarınızı 30 saniyede oluşturun, dakikalar içinde güvenli ve şifreli veri transferi yapın.