Build on the music credit graph.

Provision a key, send it in the x-api-key header, call the gateway.

# 1 · x-api-key auth on every request — keys come from the console
export MUSO_API_KEY="msk_51Ab…redacted"

# 2 · Call the versioned REST gateway — a profile's verified credits
curl "https://api.platform.muso.ai/v1/profile/e979669b-d99b-46be-91d6-bf1f1e2f44bf/credits" \
  -H "x-api-key: $MUSO_API_KEY"

# → 200 OK, x-request-id, x-ratelimit-remaining on the response

Three short, real walkthroughs — pick the one that matches what you're building. Each is copy-paste and ends with something working.

11 operations across 3 tags in one machine-readable document. Generate clients, mocks, and types from the spec.

{
  "result": "ok",
  "code": 200,
  "data": {
    "limit": 1,
    "offset": 0,
    "totalCount": 11701,
    "items": [
      {
        "credits": [
          { "child": "Primary Artist", "parent": "Artist" },
          { "child": "Composer", "parent": "Songwriter" }
        ],
        "track": {
          "id": "bedcc139-9403-4f75-ba89-5ba7deef64d4",
          "title": "Janice STFU",
          "popularity": 97,
          "isrcs": ["USUG12604763"],
          "spotifyId": "514joG57v4yKTsfQmz7stz"
        },
        "album": {
          "id": "9b78e38b-785d-4e52-8bee-3110fe1bd3a1",
          "title": "ICEMAN"
        },
        "releaseDate": "2026-05-15"
      }
    ]
  }
}

Throughput is capped so the graph can't be cloned. Every response carries pacing headers; a 429 always includes Retry-After.

HTTP/2 200
content-type: application/json
RateLimit-Limit: 30
RateLimit-Remaining: 29
RateLimit-Reset: 35
X-RateLimit-Limit-Minute: 30
X-RateLimit-Remaining-Minute: 29
X-Kong-Request-Id: 6925703b19f0c6484300e429c8d91d59

HTTP/2 429
Retry-After: 35
RateLimit-Remaining: 0
RateLimit-Reset: 35
X-Kong-Request-Id: 6925703b19f0c6484300e429c8d91d59

# 429 comes from the gateway, so it carries the gateway error shape
# (a message, no result/code envelope). Wait RateLimit-Reset seconds.

List endpoints page with limit and offset, and report the full size as totalCount. Read rows from data.items.

# First page — limit/offset. MAX limit is 50; asking for more is a 400.
GET https://api.platform.muso.ai/v1/profile/e979669b-d99b-46be-91d6-bf1f1e2f44bf/credits?limit=50&offset=0

{
  "result": "ok",
  "code": 200,
  "data": {
    "limit": 50,
    "offset": 0,
    "totalCount": 11701,
    "items": [ /* up to 50 records */ ]
  }
}

# Next page — advance offset by limit. Stop when offset >= totalCount
# (a page past the end returns items: [], not an error).
GET https://api.platform.muso.ai/v1/profile/e979669b-d99b-46be-91d6-bf1f1e2f44bf/credits?limit=50&offset=50

# Asking for a bigger page than the API allows
GET https://api.platform.muso.ai/v1/profile/e979669b-d99b-46be-91d6-bf1f1e2f44bf/credits?limit=100

HTTP/2 400
{ "result": "error", "code": 400, "message": "Too big page, max page size is 50" }

Two shapes, and which one you get tells you how far the request travelled. The API answers with the same envelope it uses for success — result: "error", code, message. The gateway rejects auth and quota problems before the API runs, so those carry message and a request_id instead.

# API errors — same {result, code} envelope as a success, result: "error"
HTTP/2 400
{ "result": "error", "code": 400, "message": "Too big page, max page size is 50" }

# Gateway errors — your request never reached the API, so there is no
# result/code envelope. Log request_id; it is what support will ask for.
HTTP/2 401
{ "message": "No API key found in request", "request_id": "6925703b19f0c6484300e429c8d91d59" }

Put a live, verified Muso profile card or roster on any website — like a YouTube embed for music credits. Two lines of HTML, or a React component. Both use a publishable key that's safe in public code.

<div data-muso-profile="e979669b-d99b-46be-91d6-bf1f1e2f44bf" data-muso-key="mpk_your_key"></div>
<script src="https://platform.muso.ai/embed/v1.js" async></script>

<div data-muso-roster="e979669b-d99b-46be-91d6-bf1f1e2f44bf,another-profile-id"
     data-muso-key="mpk_your_key"></div>
<script src="https://platform.muso.ai/embed/v1.js" async></script>

// The @muso-ai/embeds package is not on public npm yet — the hosted
// /embed/v1.js script below renders the same component with no install.
import "@muso-ai/octave-ui/globals.css";
import { MusoProfileCard, MusoRoster } from "@muso-ai/embeds";

export default function Page() {
  return <MusoProfileCard entityId="e979669b-d99b-46be-91d6-bf1f1e2f44bf" apiKey="mpk_your_key" />;
  // <MusoRoster profiles={[id1, id2]} apiKey="mpk_your_key" /> renders a grid
}

A second key type for browser code. Publishable keys (mpk_) are read-only, locked to your domains, and safe to ship in page source — the credential the widgets use.

# Publishable keys hit the read-only embed surface (CORS-open, 120/min)
curl "https://api.platform.muso.ai/embed/v1/profile/e979669b-d99b-46be-91d6-bf1f1e2f44bf" \
  -H "x-api-key: mpk_dfa3dcbb707a13d8db910f5cfe5eb904"
# Also: /profile/{id}/credits · /charts · /collaborators — GET only.
# The same key on the paid /v1 surface returns 403 by design.

Give Claude, ChatGPT, or any agent tool-based access to the credit graph — ask 'who produced this track?' in plain language and get real answers. Twelve live tools, on the same key and meter as the REST API.

# WORKS TODAY — zero install. Point any MCP client at the hosted endpoint:
#   https://mcp.muso.ai/mcp
# Transport: Streamable HTTP. Auth: your msk_ key in the x-api-key header.

# A local `muso-mcp` package is built but NOT yet on PyPI, so
# A local package exists but is not on PyPI, so there is nothing to
# install today. Use the hosted endpoint above.

{
  "mcpServers": {
    "muso": {
      "command": "muso-mcp",
      "env": {
        "MUSO_API_KEY": "msk_your_key_here",
        "MUSO_API_BASE_URL": "https://api.platform.muso.ai/v1"
      }
    }
  }
}

Look up verified credits, profiles, and search from your terminal — then copy the same calls into your app. One binary, your secret key, the live API.

# The CLI is built and working, but Muso-AI/muso-cli is still a PRIVATE
# repo, so `go install` cannot resolve it from outside the org yet and
# there are no public release archives. Nothing to install today.
#
# Everything the CLI does, the REST API does now — see the Quickstart.
# This section documents the commands so the interface is stable when it ships.

muso login                 # paste your msk_ key — stored 0600 at ~/.muso/config.json
# or, for CI:  export MUSO_API_KEY=msk_…

$ muso whoami
Authenticated ✓
  key      msk_…2684
  base_url https://api.platform.muso.ai/v1

$ muso profile e979669b-d99b-46be-91d6-bf1f1e2f44bf
Drake
  country        Canada
  credits        11689
  collaborators  15754
  popularity     97

$ muso credits e979669b-d99b-46be-91d6-bf1f1e2f44bf --limit 3
11689 total credits (showing 3)
TRACK            ALBUM                RELEASED
Janice STFU      ICEMAN               2026-05-15
NOKIA            $ome $exy $ongs 4 U  2025-02-14
Whisper My Name  ICEMAN               2026-05-15

$ muso search drake --json | jq '.items[0].name'
"Drake"

Push live analytics deltas to your app over a WebSocket instead of polling — chart moves and consumption signals as they happen. Part of the streaming-analytics tier; the delivery endpoint is rolling out.

// Streaming analytics — connection lifecycle.
// Your dedicated wss:// endpoint + token are issued with the
// streaming subscription (Console → Limits → Streaming analytics).
const ws = new WebSocket(STREAM_ENDPOINT); // wss://… (issued per account)

ws.onopen = () => {
  // 1 · authenticate, then 2 · subscribe to a channel
  ws.send(JSON.stringify({ connect: { token: STREAM_TOKEN } }));
  ws.send(JSON.stringify({ subscribe: { channel: "profile:e979669b-d99b-46be-91d6-bf1f1e2f44bf" } }));
};

ws.onmessage = (e) => {
  const frame = JSON.parse(e.data);
  // frames: { channel, data: { metric, value, at } } — deltas, not snapshots
  if (frame.data) render(frame.channel, frame.data);
};

// Reconnect with exponential backoff + jitter. Resubscribe on open —
// the server replays nothing; treat the stream as live-only and
// backfill gaps from the REST charts endpoint.
let attempt = 0;
function reconnect() {
  const wait = Math.min(30_000, 1_000 * 2 ** attempt) * (0.5 + Math.random());
  setTimeout(() => { attempt += 1; connect(); }, wait);
}
ws.onclose = reconnect;   // attempt = 0 again after a healthy minute

One key, four surfaces. SDKs handle auth, retries with backoff, and limit/offset paging.

# TypeScript — typed client + models from the live spec.
# Pin typescript@5: the generator reads your project's TypeScript and
# crashes on TS 7 (verified). Use "type": "module" in package.json.
npm i -D typescript@5 @hey-api/openapi-ts
npx @hey-api/openapi-ts -i https://platform.muso.ai/openapi.yaml -o src/muso

# Python — openapi-generator against the same document
npx @openapitools/openapi-generator-cli generate \
  -i https://platform.muso.ai/openapi.yaml -g python -o muso_client

Let your users sign in with their Muso account and see, live, the data their membership allows — their own credits, and analytics on Pro. Standard OpenID Connect; user-consented; scoped to the signed-in user's own data. Flat fee per registered app, never metered.

# Discovery — endpoints, keys, everything your OIDC library needs
curl https://login.muso.ai/.well-known/openid-configuration

# authorization_endpoint  https://login.muso.ai/api/auth/oauth2/authorize
# token_endpoint          https://login.muso.ai/api/auth/oauth2/token
# userinfo_endpoint       https://login.muso.ai/api/auth/oauth2/userinfo
# jwks_uri                https://login.muso.ai/api/auth/jwks
# grants                  authorization_code (+ PKCE), refresh_token
# scopes                  openid profile email offline_access

Already pay for Muso Pro or Business? Your own roster's credits & stats are free through the Workspace API key — a read-only key scoped to the profiles on your roster. It's issued and managed inside the Muso app, not here.

# Create/rotate the Workspace key in the Muso app:
#   app.muso.ai → Settings → API Key  (owner + active Pro/Business sub)
export MUSO_WORKSPACE_KEY="<your workspace key>"

# List the profiles on your roster (own data, free)
curl "https://api.muso.ai/api/c/v4a/workspace/roster" \
  -H "workspace-api-key: $MUSO_WORKSPACE_KEY"

How capacity, billing, and account features work — everything is self-service.

Your subscription licenses Muso credits & stats for use INSIDE your own application, for your own users. It does not grant the right to resell, redistribute, or feed Muso data into another product or service — and it is a LIVE license: data is fetched from the API at the moment of use, never stored on your side.

Everything we ship, in one place — with exactly where to get it. Hosted resources work right now with no install. Client libraries are publishing to public registries (scoped GitHub Packages today); the hosted embed script and API need no package at all.

<div data-muso-profile="e979…44bf" data-muso-key="mpk_…"></div>
<script src="https://platform.muso.ai/embed/v1.js" async></script>

curl https://platform.muso.ai/openapi.yaml -o muso-openapi.yaml
# Postman / Insomnia → Import → paste the URL

{ "mcpServers": { "muso": {
  "url": "https://mcp.muso.ai/mcp",
  "headers": { "x-api-key": "msk_…" }
} } }

# scoped registry (GitHub Packages) — public npm rolling out
echo "@muso-ai:registry=https://npm.pkg.github.com" >> .npmrc
# Not on public npm yet — generate a typed client from the spec instead (above).

# Not on public npm yet — @muso-ai/embeds resolves only
# inside the Muso GitHub Packages scope.

go install github.com/Muso-AI/muso-cli/cmd/muso-api@latest
# Prebuilt release archives are rolling out.

curl https://login.muso.ai/.well-known/openid-configuration