繁體中文

NFC42 Developers

Company data API & MCP server · Okle42

What is it?

The NFC42 API / MCP add-on lets AI assistants and your company systems work with your company’s NFC42 data: look up stock, find low-stock items, missed patrols, tools that are lent out and equipment due for service, and record stock in/out, counts, lends, returns and services.

• MCP server for AI assistants (Claude, ChatGPT and other MCP clients): https://nfc42-okle42.web.app/mcp
• REST API for scripts, ERP and spreadsheets: https://nfc42-okle42.web.app/api/v1/

Both use the same API keys, the same rules and the same daily limit. Changes appear in the app like any other record, marked with the key's name.

Get an API key

1. The owner of the company opens the NFC42 app → Company → API / MCP.
2. Subscribe to the API / MCP add-on (monthly or yearly, one per company). New companies can try it free for the first 7 days.
3. Tap Create Key, give it a name (for example “Claude” or “ERP”) and choose Read or Read & Write.
4. Copy the key. It starts with nfc42_sk_ and is shown only once. Up to 10 active keys per company.

Every request sends the key in the Authorization header: Authorization: Bearer nfc42_sk_…

Connect an AI assistant (MCP)

Server URL: https://nfc42-okle42.web.app/mcp · Transport: Streamable HTTP (stateless, JSON responses) · Auth: Bearer API key.

Claude Code

claude mcp add --transport http nfc42 https://nfc42-okle42.web.app/mcp --header "Authorization: Bearer <key>"

Claude Desktop

Open Settings → Developer → Edit Config and add this to claude_desktop_config.json (uses the mcp-remote bridge, which needs Node.js), then restart Claude Desktop:

{
  "mcpServers": {
    "nfc42": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://nfc42-okle42.web.app/mcp",
               "--header", "Authorization:${NFC42_AUTH}"],
      "env": { "NFC42_AUTH": "Bearer nfc42_sk_..." }
    }
  }
}

ChatGPT and the OpenAI API

ChatGPT's connector screen currently connects with OAuth or without authentication, so it cannot send an NFC42 key header. With the OpenAI Responses API you can pass the header directly:

"tools": [{
  "type": "mcp",
  "server_label": "nfc42",
  "server_url": "https://nfc42-okle42.web.app/mcp",
  "headers": { "Authorization": "Bearer nfc42_sk_..." },
  "require_approval": "never"
}]

Any other MCP client that can send a custom header works the same way.

Tools

Keys with read scope see only the read tools; write keys see all of them. Items can be given by ID or by exact name (case-insensitive). If several items share a name, the call fails and lists their IDs.

REST API

Base URL https://nfc42-okle42.web.app/api/v1. JSON in, JSON out. {id} is an item ID (or a URL-encoded exact name).

Examples

curl https://nfc42-okle42.web.app/api/v1/low-stock \
  -H "Authorization: Bearer $NFC42_KEY"

curl -X POST https://nfc42-okle42.web.app/api/v1/items/$ITEM_ID/stock-out \
  -H "Authorization: Bearer $NFC42_KEY" \
  -H "Content-Type: application/json" \
  -d '{"amount": 3, "note": "Order #1024"}'

Response:

{ "recordId": "4D471D77-B0B2-4C1B-B6E5-5B49BAF0ADE4",
  "item": { "id": "…", "name": "Packing tape", "kind": "stock" },
  "kind": "outbound", "delta": -3, "quantityBefore": 10, "quantity": 7 }

Errors

Errors return {"error": "code", "message": "…"}.

In MCP, tool failures come back as a tool result with isError: true; the daily limit is a JSON-RPC error (code −32029).

Limits

• 2,000 calls per key per day (MCP tool calls and REST requests; resets at midnight Taiwan time). initialize and tools/list don't count.
• Check-ins are not available through the API. Patrol check-ins, cleaning sign-offs and asset audits must be done on site by tapping the NFC tag in the app — that is what makes them trustworthy.
• Attendance and door locks are counts only. Staff names, clock times, guest names, card numbers and passcodes are never returned, and doors can't be unlocked or cards issued through the API.
• Scopes: read keys can only look; write keys can also add items and record stock, lends, returns and services. Neither can delete anything or change members.
• If the Business plan ends, the inventory becomes read-only: reads keep working while the add-on is active, writes are refused.

Security

• Treat a key like a password. Don't put it in web pages, mobile apps or public repositories; call the REST API from a server.
• Use a read key unless the integration really needs to write. Create one key per integration so you can revoke one without breaking the others.
• If a key leaks, revoke it in the app (Company → API / MCP). It stops working immediately.
• AI assistants act with the key's permissions. Review what a write-enabled assistant is about to do before you approve it.
• We store only a hash of each key; we can't show a lost key again — create a new one.