Madnion Platform

Multi-tenant workspace/app platform backing Series-X SSO, the CRM and client workspaces. Base API: https://api.madnion.com/functions/v1/<endpoint> (prefix mandatory).

CLI

@madnion/cli v1.4.0 (madnion, madnion-mcp). Auth via MADNION_ADMIN_KEY env.

madnion whoami | describe <resource> | skills | tools [resource]
madnion call <resource> <action> [--key=val | --json='{...}'] [--raw]
madnion plan --file= | batch --file= [--dry-run] [--allow-destructive] [--continue-on-error]

22 resources: apps, users, workspaces, stripe, stripe_config, stripe_connect, plans, credits, sessions, audit, integrations, ai, proxies, emails, webhooks, linkedin, admin_keys, meta.

Key types

Key	Use
`mad_admin_…`	platform admin (all workspaces, destructive ops)
`wak_builder_…`	builder bootstrap (`madnion bootstrap` requires this, admin key → NOT_FOUND)
app-scoped	per-app runtime auth

Never hand customers admin or builder keys.

SSO (Series-X CRM)

App: Series-X CRM (app_zkXUugCWwr4jnAav7vBEOskx) in workspace pym4
Redirect: https://crm.series-x.ai/auth/callback; allowed origin: https://crm.series-x.ai
Exchange: POST /auth/exchange (code → tokens), GET /auth/whoami (profile + admin check)
The edge function crm-api (Supabase) wraps these for the SPA.

Workspaces

Short code	Workspace
`pym4`	Series-X main
`cynf`	MORe (Atlas app lives here)
`5lai43`	Setu Dental (AdvisorOS)

Proxy resources

Custom proxies (e.g. ClickUp) follow the schema: endpoint, auth_config, headers, actions. Create with madnion call proxies create --json='{...}' in the target workspace.

Pitfalls

All endpoints under /functions/v1/ — root-level paths 404.
Escrow features currently paused.
Org-style token blocks don't apply (Madnion, not GitHub), but classic-PAT age limits DO apply to the GitHub org series-a-uk (366-day rule) — use fine-grained tokens or gh auth login --web.