The dashboard is a client. Your code gets the same API.

Meisei is an API-first reviews, loyalty and wishlist platform. Anything our dashboard can do, your code can do with the same REST API, because that's what the dashboard uses.

Start a free trial Read the API reference

The API: everything the dashboard does

GET /reviews?filter={"rating":{"$gte":4}}
POST /loyalty-events
GET /wishlists?include="items"
POST /analytics/query

One API for the dashboard and your code.

An API added beside a product falls behind it. Meisei's dashboard calls the same API you do, so every feature is in the API the day it ships.

Everything the dashboard does: One REST API covers reviews, loyalty, wishlists, customers, orders, products and analytics, because the dashboard is built on it.
One filter language: List endpoints take the same JSON filter document the dashboard's filter bars produce, so a filter you build on a screen is a filter your code can run verbatim.
A typed client: The @meisei/api package is generated from the same OpenAPI documents as the reference docs, so your editor knows every route, parameter and response shape.
Webhooks: Meisei sends each change to your endpoint as it happens, so a review published in the dashboard reaches your systems without polling.
CSV in, CSV out: Products, customers, orders, reviews and loyalty history all import from CSV and export back to it. The importer skips a row it cannot match, reports its line number and carries on.
Published rate limits: One documented, organization-wide limit, with a Retry-After header when you reach it.

Keys you can hand to a contractor.

Every key lists what it can read and write, and every route names the scope it checks.

Secret keys are scoped. Twelve resource groups each have separate read and write scopes, so a key holds only the ones it needs, and a 403 names the missing permission.
Write does not imply read, and every admin route declares the scope it checks. The key edit screen shows the same checklist the API enforces.
Keys carry optional expiry presets and rotate without downtime, and an IP allowlist in CIDR form pins a key to the machines that should hold it.
OAuth 2.1 with PKCE for user-facing integrations, with the same scopes as secret keys.

Your AI tools can use it too.

Meisei ships an MCP server, so Claude and any other MCP client can read and act on your store with your permission.

Connect from claude.ai with OAuth and no installation, or run the local binary with a secret key from Claude Code or Cursor. Either way, every tool call goes through the same documented API with the credentials you granted, so an agent can never do more than the key or token it holds.

Writes are off unless you turn them on, so a read-only agent stays read-only.

Remote, from any MCP client

https://meisei.app/mcp
# OAuth 2.1, scopes you approve

Local, with a secret key

MEISEI_API_KEY=sk_live_9f2c \
  meisei-mcp

Questions, answered.

Is the API available on every plan?

Yes. API keys, OAuth, webhooks and the MCP server are on every plan, including the $19 one.

Is there an SDK?

There's a typed TypeScript client, @meisei/api, generated from the same OpenAPI documents as the reference docs. Any language that speaks HTTP works too.

Can I build a headless store with Meisei?

Yes. Use the REST API directly, drop in the script-tag widgets, or render the React components on the server with Next.js.

How do rate limits work?

One documented, organization-wide limit, with a Retry-After header when you reach it.

Can AI agents use Meisei?

Yes. Meisei has an MCP server for Claude and other MCP clients, connected with OAuth or a scoped key. Writes are off unless you turn them on.

The rest of Meisei.

Every feature shares one customer record and one bill. Turn on the ones you need.