Recurex

Reference

API Endpoints

HTTP API routes exposed by Recurex.

MCP server

GET|POST|DELETE /api/mcp

MCP JSON-RPC server for AI connectors. Requires Authorization: Bearer <token>.

MethodPurpose
GETServer metadata
POSTJSON-RPC (initialize, ping, tools/list, tools/call)
DELETESession teardown
OPTIONSCORS preflight

OAuth

EndpointMethodPurpose
/api/oauth/authorizeGET, POSTAuthorization + consent
/api/oauth/tokenPOSTToken exchange / refresh
/api/oauth/registerPOSTDynamic client registration (RFC 7591)

Discovery

EndpointStandard
/.well-known/oauth-authorization-serverRFC 8414
/.well-known/oauth-protected-resourceRFC 9728
/api/mcp/.well-known/oauth-protected-resourceRFC 9728

Webhooks

POST /api/razorpay/webhook

Razorpay subscription lifecycle events. Verified via x-razorpay-signature HMAC.

Handled events:

EventResult
subscription.activated, charged, resumedPlan → pro/team, active
subscription.pending, haltedPlan → past_due
subscription.cancelled, completed, expiredPlan → free, canceled

Auth callback

GET /auth/callback

Supabase OAuth code exchange. New users without country → /onboarding.

Cron (internal)

See Cron Jobs. Authenticated via CRON_SECRET.

Middleware bypass

These paths skip session middleware: api/mcp, api/cron, api/razorpay, auth/callback.

External vs internal

RouteFacing
/api/mcpExternal (AI clients)
/api/oauth/*External (OAuth clients)
/api/razorpay/webhookExternal (Razorpay only)
/api/cron/*Internal (Vercel Cron)

There is no public REST API for expense CRUD outside MCP.

PreviousEnvironment VariablesNextCron Jobs