We’re building Ever Works in public. Some things may be incomplete, missing, or broken while we continue improving the platform.We’re building Ever Works in public — expect a few rough edges.
Developers · Programmatic access
The dashboard is a client, not the product. Works, Missions, Ideas, Agents, Tasks, plugins and billing all sit behind the same REST API, described by a single OpenAPI document that the running server and the build-time generator share so the two never drift. Authenticate as a person with a session token, or as a machine with an ew_live_ API key from CI, the CLI, or the MCP server — then get the platform’s side of the conversation back as HMAC-signed webhooks.
Two credentials, one guard. The ew_live_ prefix decides which path a request takes, and a bad key fails as a bad key rather than quietly falling back to a session.
POST /api/auth/register or /api/auth/login returns an access token and a refresh token — seven and fourteen days by default — refreshed at /api/auth/refresh and revocable everywhere at once with /api/auth/logout-all. Social sign-in runs through /api/oauth for GitHub, Google, Facebook and LinkedIn, with magic-link email available when an operator enables it.
A key is ew_live_ plus 64 hex characters — 72 characters in total, shown exactly once at creation. Only the first twelve characters are kept in clear as a label; the rest is stored as a SHA-256 hash, so a key can be revoked but never re-read. Up to ten active keys per user, each with an optional expiry and a last-used stamp that advances on every successful call.
Server-side and CLI callers use the x-api-key header; browser clients must use Authorization: Bearer, because CORS on the API allows only Content-Type and Authorization. Either way the guard treats the ew_live_ prefix as the discriminator, so a bad key returns 401 instead of authenticating as somebody else.
Three throttle tiers apply at once — 50 requests a second, 300 per ten seconds, 1,000 a minute — and any breach returns 429. Helmet sets the security headers, CORS is pinned to your allowed origins, error reports are stripped of authorization headers and password / token / secret fields, and the ownership-gated surfaces — organizations, Missions and Ideas, and a fleet endpoint switched off by configuration — answer 404 rather than 403, so ids there cannot be enumerated.
Registration records what you actually agreed to. The signup page fetches the legal documents in your locale before it renders, shows you that exact text, and stores the document id, its version, the SHA-256 digest of the published source and the locale it was displayed in against your new account — so the wording you accepted can be reproduced later. The server re-checks every field against its published corpus first, and if the documents cannot be loaded at all the form blocks registration rather than writing an empty consent record.
Six ways in and out of the platform — all on the same credential, all documented.
A non-production API serves an interactive explorer at /api/swagger, a modern reference at /api/docs, and the raw specification at /api/openapi.json. All three are deliberately switched off in production — generate the spec offline instead with pnpm --filter ever-works-api generate:openapi, which introspects the controllers without starting a listener or touching a database.
POST /api/v1/chat/completions speaks the OpenAI chat-completions wire format, so any client that lets you set a custom base URL can talk to Ever Works with no bespoke integration — streaming, tools and tool choice included. Send an x-work-id header and the request answers in that Work’s context: @kb: mentions resolve against its Knowledge Base and the reply cites what it used, as kb:brand/voice.
Register HTTPS endpoints with POST /api/webhooks — up to 25 active per account, optionally scoped to a single Work — and receive work.created, work.generation.completed and deployment.dispatched / completed / failed as signed POSTs. Every delivery carries a sha256 HMAC in X-Ever-Works-Signature-256, with an X-Hub-Signature-256 alias for receivers that already parse that shape. Fire a test delivery before you wire CI, re-enqueue any past delivery by id, and rotate the secret without rebuilding the subscription.
Each trigger owns a public endpoint and its own secret: sign the timestamp and raw body with HMAC-SHA256, POST to /api/inbound-triggers/:id/fire, and a verified call spawns a Task from the trigger’s template, assigned to the Agent you nominated. A five-minute replay window, duplicate suppression on the delivery id, and a 24-hour grace after a rotation keep retries safe. Manage them under Tasks → Triggers.
GET /.well-known/agent.json publishes an agent card saying what the platform can do and where to call it. An agent that finds it can POST /api/register-work with an X-GitHub-Token: the API validates the credential against the named repository, creates an account if that identity has none, reads .works/works.yml, and returns 202 with a status URL and the assigned subdomain — idempotent per identity and repository.
GET /api/account/export snapshots the whole account — profile, every Work, plugin configuration — as a versioned JSON document with secret settings masked unless you deliberately ask for them, and the matching import replays it. A GitHub sync pushes the same snapshot to a repository you own, and GET /api/activity-log/export streams the filtered audit trail as CSV.
Against the hosted API at api.ever.works, or your own on port 3100.
Open Settings → API Keys at /settings/api-keys, click Create API Key, give it a name like “CI Pipeline” and an optional expiration, then hit Copy to clipboard in the dialog. The full key is shown once and can never be retrieved afterwards, so put it straight into your secrets manager.
curl https://api.ever.works/api/works -H "x-api-key: ew_live_…" lists the Works on the account. If that returns what you expect, every other route on the API is now open to the same credential.
POST /api/works with a JSON body creates a Work; generation, items, scheduling and deployment all hang off the same /api/works prefix. Unknown fields are rejected rather than ignored, so treat the OpenAPI document as the contract.
POST /api/webhooks with your receiver URL and store the signing secret from the response — it appears only there. Then POST /api/webhooks/:id/test, check the signature on your side, and you are wired for every generation and deployment event that follows.
There is no Ever Works SDK package to install. The official clients are the CLI, the MCP server, and the OpenAPI document itself — point your usual generator at /api/openapi.json and you get a typed client in whichever language you actually work in. A few other edges are worth knowing before you build against them.
Manage Works from any MCP-compatible assistant — 127 API tools plus Knowledge Base tools, authenticated with an API key, over stdio or HTTP.
Learn more →Create, generate, deploy and register Works, manage plugins and the knowledge base from your terminal — npm install -g ever-works-cli.
Learn more →Work refreshes, Mission ticks, Agent heartbeats, recurring Tasks and webhook triggers — every clock and every hook in one Schedules view.
Learn more →Drive the platform from Slack, get pull requests reviewed against your knowledge base, and turn meetings into memory.
Learn more →Run several organizations from one account, invite people into them, grant real per-Work roles — and get the security defaults underneath all of it.
Learn more →Describe what you want to build. Ever Works researches it, ships it, and keeps it improving — content and code, owned in your own Git.