Five products · live in production
Auth, Mail, Waitlist, Social and Trawl — five REST APIs behind one account, one API key and typed Node SDKs. Install the parts you keep rebuilding; build the part only you can.
Each service has a free tier large enough to ship a side project on. Pricing is coming soon.
npm install productcraftimport { ProductCraft } from "productcraft";
const pc = new ProductCraft({
auth: {
type: "apiKey",
key: process.env.PCFT_KEY!,
},
});
// Auth — sign in an EndUser
const consumer = pc.auth.consumer("my-app");
const tokens = await consumer.auth.signin({
identifier: "alice@example.com",
password: "...",
});import { ProductCraft } from "productcraft";
const pc = new ProductCraft({
auth: { type: "apiKey", key: process.env.PCFT_KEY! },
});
// Auth — sign in an EndUser through the BFF flow
const consumer = pc.auth.consumer("my-app");
const tokens = await consumer.auth.signin({
identifier: "alice@example.com",
password: "...",
});
// Mail — send a template-rendered email from the same backend
await pc.mail.client.POST(
"/v1/workspaces/{workspace_id}/templates/{name}/send",
{
params: {
path: { workspace_id: "<workspace-uuid>", name: "welcome" },
header: { "Idempotency-Key": "welcome-2026-05-22-alice" },
},
body: {
from: "hello@yourbrand.com",
to: "alice@example.com",
data: {},
},
},
);The lineup
Use one or all five. Each is its own REST API with its own docs, npm package and console pages; the account, the API key and the workspace are shared.
The boring half
In the console: Apps · End users · Roles · Tenants · Passkeys · Audit
ProductCraft's own transactional email goes through it.
In the console: Domains · SMTP relay · Templates · Messages · Suppression list
// No auth — public surface
POST /v1/waitlists/{workspace_slug}
/{waitlist_slug}/entries
// → { id, position }In the console: Overview · Waitlists · Webhooks · Settings
The interesting half
import { Trawl } from "@productcraft/trawl";
const trawl = new Trawl({
auth: {
type: "apiKey",
key: process.env.PCFT_KEY!,
},
});
const { data, error } =
await trawl.client.POST(
"/v1/workspaces/{workspaceId}/jobs",
{
params: {
path: { workspaceId: "<workspace-uuid>" },
},
body: {
description:
"Extract the product title " +
"and price from each page.",
json_schema: {
type: "object",
properties: {
title: { type: "string" },
price: { type: "number" },
},
required: ["title"],
},
suggested_urls: [
"https://example.com/product",
],
},
},
);
if (error) throw error;
console.log(data.id, data.status);
// → "<job-uuid>", "queued"import { Trawl } from "@productcraft/trawl";
const trawl = new Trawl({ auth: { type: "apiKey", key: process.env.PCFT_KEY! } });
const { data, error } = await trawl.client.POST(
"/v1/workspaces/{workspaceId}/jobs",
{
params: { path: { workspaceId: "<workspace-uuid>" } },
body: {
description: "Extract the product title and price from each page.",
json_schema: {
type: "object",
properties: { title: { type: "string" }, price: { type: "number" } },
required: ["title"],
},
suggested_urls: ["https://example.com/product"],
},
},
);
if (error) throw error;
console.log(data.id, data.status); // → "<job-uuid>", "queued"In the console: Jobs · Webhooks
POST /v1/communities/{communityId}
/posts
X-Acting-As: <actor_id>
{
"actor_id": "<actor-uuid>",
"text": "Hello, world!",
"visibility": "public"
}In the console: Overview · Analytics · Moderation · Settings
Pick the one that brought you here. The other four are already in your workspace.
One workspace
Sign in once at auth.productcraft.co and every product trusts the same session. A workspace owns your apps, domains, templates, waitlists, communities, jobs and API keys, and the console shows the same workspace for all five.
{
"token": "eyJhbGciOiJSUzI1NiIs...",
"permission": "user.read"
}
→ { "authorized": true }From your editor
An MCP server at mcp.productcraft.co. You approve the connection in the browser, a policy preset caps what it may do, and every call lands in the audit log.
claude mcp add --transport http productcraft 'https://mcp.productcraft.co/mcp'
# then, inside Claude Code:
/mcp # pick "productcraft" and follow the browser promptNote what is not in any of those snippets: a token, a key, a client id, a secret. The only configuration is the URL.
Changelog
Every entry is a production deploy. The full list is on the changelog.
Auth apps can now let the members of each tenant create API keys for their own CI, scripts and end-to-end tests. Keys are scoped to one tenant and to scopes your app defines, never above their creator's role, always expire, and your backend verifies them with one cached call.
Setting up Google, GitHub or Apple sign-in for an Auth app is now five steps in the console, from the provider console link to a real Try sign-in, and every save tells you straight away whether the provider accepts your credentials. New docs guides for Google and GitHub.
Waitlist, Trawl and Social now have the same Webhooks pages in the console as Mail and Auth: add several endpoints, pick events from described lists, Send test and see what your server answered, browse the event log and replay. Trawl shows a banner when your credits run low, and one guide explains signatures, retries and replay for every product.
Open a workspace, create an API key, call the product that brought you here. The other four are on the same key.