API & MCP access

API & MCP access

Metricgram includes a public API and an MCP server for connecting your own tools, dashboards, automations, or AI clients to the data and operations available in your account.

The MCP server is available on every paid plan and during the 14-day free trial. AI clients can connect with OAuth (paste the server URL and approve access) or with an API key. The REST API requires Elite access. If your account does not include it, the API section may appear locked or show an upgrade message.

Where to find it

Open Integrations > MCP or Integrations > API in the manager panel. From there, accounts with access can create API tokens, review active tokens, revoke tokens, and see the technical reference available for their plan.

How tokens work

• Tokens belong to your Metricgram user account, not to a single group.
• A token can access the groups and resources that your account can manage.
• Tokens include permission scopes for areas such as groups, members, messages, automations, subscribers, analytics, support tickets, referrals, and MCP.
• Some endpoints read data; others can create, update, moderate, or trigger actions depending on the token permissions.
• The token value is shown only once when it is created. Store it securely.

Telegram Bot API through MCP

The MCP server also exposes a group-scoped Telegram Bot API, so AI agents can act in your groups through the Metricgram bot or your custom bot.

• Use telegram_api_methods to list the methods your token can call, and telegram_bot_api to call any of them with the official Bot API parameters.
• Typed tools cover everyday work: send_telegram_message, send_telegram_media, send_telegram_poll, pin_telegram_message, manage_forum_topic, create_telegram_invite_link and more.
• The chat is always one of your own groups. You never pass a chat_id; Metricgram derives it from the group_id.
• Telegram actions use their own scopes: telegram:read, telegram:write, telegram:moderate and telegram:admin. Tokens created before these scopes existed must be recreated to use them.
• Media must be a public HTTPS URL or a Telegram file_id, and inline buttons can only open URLs or copy text.
• Write tools accept an optional idempotency_key, so a retried call does not act twice.

Authentication and limits

API requests use the Authorization: Bearer mg_... header. The default limit is 600 requests per minute per token, and the token form lets you choose a value between the minimum and maximum allowed by the app.

If a token is revoked, the user account loses API access, or the account no longer has a plan with API access, requests using that token will be rejected.

Good practices

• Create separate tokens for different external tools.
• Use clear names so you can identify where each token is used.
• Revoke tokens you no longer need.
• Do not share tokens in chats, screenshots, tickets, or public repositories.