MaxiBestOf developer portal

Use the public API to list website designs. Use the MCP server to search designs, fonts, color palettes, sections, and your favorites.

MaxiBestOf API quickstart

GET /api/websites?page=1 returns published websites. This endpoint does not require authentication. Each page contains up to 32 websites. The response contains websites and count. Use count.pages to stop pagination.

curl 'https://maxibestof.one/api/websites?page=1'

The OpenAPI specification describes the public integration endpoints. Admin routes and private browser session routes are outside this API contract.

MaxiBestOf authentication and credentials

The public website API and sample sandbox need no API key. MCP uses OAuth 2.0 Bearer access tokens. Register a client to get a client ID. Public clients use PKCE with S256 and do not need a client secret. There is no separate static API key service.

  1. Read authorization server metadata and protected resource metadata.
  2. Register your callback URL at POST /api/mcp/register. Keep the returned client_id.
  3. Create a random state and a PKCE verifier. Compute the S256 challenge. Open /api/mcp/authorize in a browser with response_type=code, client_id, redirect_uri, state, code_challenge, code_challenge_method=S256, scope=mcp:read, and resource=https://maxibestof.one/mcp-server. The user signs in to MaxiBestOf.
  4. Validate the callback state. Exchange the code at POST /api/mcp/token with grant_type=authorization_code, code, client_id, redirect_uri, code_verifier, and the same resource. Send JSON or form data.
  5. Store tokens securely. Send Authorization: Bearer <access_token> to the MCP endpoint. Use grant_type=refresh_token, refresh_token, and client_id at the token endpoint to refresh access.
curl 'https://maxibestof.one/api/mcp/register' -H 'Content-Type: application/json' -d '{"client_name":"My design agent","redirect_uris":["http://localhost:3000/callback"],"token_endpoint_auth_method":"none","grant_types":["authorization_code","refresh_token"],"response_types":["code"],"scope":"mcp:read"}'

MCP tools require MaxiBestOf Pro. Production usage allows 1,000 tool calls per account per calendar month. The counter resets at the start of each month in UTC.

MaxiBestOf MCP server

Connect to https://maxibestof.one/mcp-server with Streamable HTTP. The MCP manifest lists the endpoint and authentication resources. The MCP setup guide has client installation steps.

Start with initialize, send notifications/initialized, then use tools/list to get the current tool names and input schemas. Use tools/call to run a tool. Send the negotiated MCP-Protocol-Version on later requests. Send MCP-Session-Id if initialization returns one.

curl 'https://maxibestof.one/mcp-server' -H "Authorization: Bearer $MAXIBESTOF_ACCESS_TOKEN" -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"my-design-agent","version":"1.0.0"}}}'

Missing or invalid Bearer tokens return HTTP 401 with an OAuth discovery challenge. GET requests do not open an SSE stream and return HTTP 405. Tool failures can return isError: true inside an HTTP 200 response. Check that field before using results.

MaxiBestOf sample sandbox

Test a JSON request without an account at GET /api/developers/sandbox. This sandbox returns fixed sample data with sandbox: true. It does not read or change the live catalog. OAuth and MCP use the production services described above.

Webhooks

MaxiBestOf does not offer public webhook subscriptions. The internal Stripe webhook is for billing. It is not a developer integration endpoint.

Curating the internet’s finest.