# Yappy developer portal

Yappy is a macOS app, but the facts about it are a public API. Releases, docs,
FAQ, and pricing are all queryable — no account, no key, no sales call — so an
agent answering "what is the current Yappy version" or "will this run offline"
reads structured data instead of scraping a marketing page.

## The two surfaces

| Surface | Endpoint | Best for |
|---|---|---|
| REST | `https://yappy.biz/api/v1` | Anything. Cursor-paginated, typed, versioned. |
| MCP | `https://yappy.biz/mcp` | LLM agents. Streamable HTTP, tools and resources. |

Both read the same data. Pick whichever your client already speaks.

## Sixty-second start

```bash
# the current release, straight from the same appcast the app's updater reads
curl -s https://yappy.biz/api/v1/releases/latest

# search the documentation
curl -s "https://yappy.biz/api/v1/search?q=accessibility+permission&limit=3"

# the full machine-readable contract
curl -s https://yappy.biz/openapi.json | jq '.paths | keys'
```

No `Authorization` header. That is not an oversight — this data is public, and
making agents mint a token to read a changelog helps nobody.

## Connect the MCP server

```json
{
  "mcpServers": {
    "yappy": { "type": "http", "url": "https://yappy.biz/mcp" }
  }
}
```

Streamable HTTP transport, seven tools, three resources, no auth. Details on the
[MCP page](https://yappy.biz/developers/mcp).

## Guides

- [REST API](https://yappy.biz/developers/rest-api) — pagination, versioning, batching, async jobs
- [MCP server](https://yappy.biz/developers/mcp) — tools, resources, annotations, MCP Apps
- [Authentication](https://yappy.biz/developers/authentication) — OAuth 2.1, PKCE, scopes, agent auth
- [Errors](https://yappy.biz/developers/errors) — the RFC 9457 problem shape and every code
- [Rate limits](https://yappy.biz/developers/rate-limits) — headers, ceilings, backoff
- [Versioning and deprecation](https://yappy.biz/developers/deprecation) — what breaks, and the 180 days of notice
- [Sandbox](https://yappy.biz/developers/sandbox) — a test environment that touches nothing real
- [API reference](https://yappy.biz/api/) — endpoint by endpoint
- [OpenAPI 3.1](https://yappy.biz/openapi.json) — generate a client from it

## Self-serve credentials

Anonymous access covers reads. If you want a higher rate ceiling or the write
scopes, register a client without talking to anyone:

```bash
curl -sX POST https://yappy.biz/oauth/register \
  -H 'content-type: application/json' \
  -d '{"client_name":"my-agent","grant_types":["client_credentials"]}'
```

That is RFC 7591 dynamic client registration. The walkthrough an agent should
follow is [`/auth.md`](https://yappy.biz/auth.md), and the discovery documents
are at [`/.well-known/oauth-authorization-server`](https://yappy.biz/.well-known/oauth-authorization-server)
and [`/.well-known/oauth-protected-resource`](https://yappy.biz/.well-known/oauth-protected-resource).

## What this API is not

It does not transcribe audio. Yappy's speech recognition runs on the user's own
Mac, on purpose, and there is no hosted endpoint to send a recording to. If your
user wants dictation, the answer is to install the app — not to call us.

## Stability

`/api/v1` is versioned in the path. Breaking changes get a new major version;
`v1` gets at least 180 days of `Deprecation` and `Sunset` headers before it stops
answering. Additive fields can appear at any time, so parse leniently. The full
[versioning and deprecation policy](https://yappy.biz/developers/deprecation) is
written down, and `GET /api/v1` reports the current status under `versioning`.

---

Canonical: https://yappy.biz/developers/ · Last updated: 2026-08-25