Growomat · Developer platform
The whole product, as an API.
Everything the Growomat app does is a versioned REST endpoint: businesses, campaigns, ad groups, ads, keywords, assets, conversions, reports and syncs, across every connected ad platform. Typed clients are generated from the same OpenAPI spec, so they cannot drift from it.
Included on every plan, the free tiers among them. No waitlist, no config, no upgrade.
- Base URL
- api.growomat.com/api/v1
- Auth
- Bearer token, Authorization header only
- Spec
- OpenAPI 3.1
- Limits
- 60 req/min per token
Three ways in
One ads platform. In our app, or yours.
The same engine behind every one of them, acting on the same live data. Whichever you pick, it is on every plan, including the free tiers.
REST
One API instead of four.
A cursor-paginated JSON API over every resource in the workspace. One response envelope, typed errors, honest rate-limit headers on every response, and a written versioning policy. Four platform APIs, reduced to one contract that does not change under you.
SDKs
Typed clients, generated from the spec.
Five languages, all generated from the same OpenAPI document that powers the app and regenerated every release. Automatic retries on 429 using the server's Retry-After, cursor pagination exposed as iterators, and typed errors. Availability differs per language, and the SDK page states which is which.
MCP
70 tools, in the assistant you already use.
A hosted MCP server at mcp.growomat.com, OAuth 2.1, no local install. Connect Claude, VS Code or Cursor and ask for the work in plain language. Every tool is tagged read-only, creates-and-edits or destructive, so your client can show the right badge before it acts.
Auth & scopes
Tokens built to be scanned, scoped and rotated.
- A fixed prefix, so GitHub secret scanning and trufflehog recognize a leaked token on sight.
- Only the SHA-256 is stored server-side. The plaintext is shown once.
- Scopes are immutable. Changing access means minting a new token.
- The sync scope is separate from every resource scope, because triggering a sync mutates external ad platforms and can spend real budget. A reporting token never needs it.
- Up to 5 tokens per account, expiry up to one year, one-click revoke. Rotation issues a new secret and keeps the token ID, so your references survive.
The safety property
Nothing you create touches a live ad platform on its own.
Campaigns are created in the workspace and staged there. They reach Google Ads, Microsoft Advertising, Reddit Ads or Meta Ads only when a token holding the sync scope triggers a sync. An agent gets reach. It never gets the keys.
Start free and mint a tokenReference
Everything else is on the developer site.
Quickstarts, the response envelope, every error code, rate-limit headers, the versioning policy, and the install command and current status for each client.