# Substack

> Substack is an independent publishing and media platform where writers, podcasters and video creators publish directly to readers and monetize through paid subscriptions. Substack does not publish a general-purpose REST API and ships no OpenAPI. Its supported machine surfaces are three: an official remote MCP server for read-only publication analytics, a narrowly scoped Developer API that resolves a LinkedIn handle to a public Substack profile, and per-publication RSS feeds.

Generated by API Evangelist from all/substack/apis.yml and the artifacts in that repo.
Substack publishes no llms.txt of its own (https://substack.com/llms.txt returns 404,
https://support.substack.com/llms.txt returns 404, checked 2026-08-13).

## Agent surfaces

- [Substack MCP server](https://mcp.substack.com/api/v1/mcp): Official remote MCP server. Read-only. Returns publication dashboard metrics, subscriber counts, revenue, post performance, traffic sources and retention. Cannot publish posts, send Notes, or modify the account, and cannot see profile or Notes activity. Requires OAuth 2.1 (authorization code + PKCE S256, scope `mcp:read`) against https://substack.com, plus Admin role on a Bestseller publication.
- [How to connect Substack to your AI Assistant](https://support.substack.com/hc/en-us/articles/50834026608916-How-to-connect-Substack-to-your-AI-Assistant): The provider's own setup guide for Claude, ChatGPT and Cursor.
- No A2A agent card, no ai-plugin.json, and no llms.txt is served on any Substack host.

## APIs

- [Substack Developer API](https://support.substack.com/hc/en-us/articles/45099095296916-Substack-Developer-API): `GET https://substack.com/profile/search/linkedin/{linkedin-handle}`. Returns public creator profile data — name, LinkedIn URL, social identity URLs, total subscriber count, Bestseller status, leaderboard recognitions, profile summary, profile URL, publication URL. Bearer token, granted by application (Substack states 7-10 business days), token minted under Settings > Developer API.
- [Substack Developer API Terms of Use](https://substack.com/api-tos): Governs the Developer API. Defines Authorized Data, permitted and prohibited uses, attribution requirements, and states that rate limits exist at Substack's sole discretion without publishing any value.
- [Publication RSS feeds](https://support.substack.com/hc/en-us/articles/360038239391-Is-there-an-RSS-feed-for-my-publication): `https://{publication}.substack.com/feed`. RSS 2.0 with content, dc, atom and itunes namespaces. No credential required. Podcast subscribers additionally receive a private per-subscriber feed.

## Discovery documents

- [OAuth 2.0 Authorization Server Metadata (RFC 8414)](https://substack.com/.well-known/oauth-authorization-server): issuer, authorization, token, registration, jwks and userinfo endpoints; scopes `openid`, `profile`, `email`, `offline_access`, `mcp:read`, `notes.read`, `notes.write`.
- [OpenID Connect Discovery](https://substack.com/oauth/.well-known/openid-configuration): served from a non-canonical path; the RFC 8615 root location returns 404. Adds device-code grant, PAR endpoint and the `apple_podcasts` scope.
- [MCP Protected Resource Metadata (RFC 9728)](https://mcp.substack.com/.well-known/oauth-protected-resource/api/v1/mcp): resource, authorization server, `mcp:read`, bearer-in-header.
- [JWKS](https://substack.com/oauth/jwks)

## Artifacts

- [apis.yml](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/apis.yml)
- [MCP server profile](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/mcp/substack-mcp.yml)
- [Authentication profile](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/authentication/substack-authentication.yml)
- [OAuth scopes](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/scopes/substack-scopes.yml)
- [Well-known index](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/well-known/substack-well-known.yml)
- [Conventions](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/conventions/substack-conventions.yml)
- [Error catalog](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/errors/substack-problem-types.yml)
- [Lifecycle](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/lifecycle/substack-lifecycle.yml)
- [Rate limits](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/rate-limits/substack-rate-limits.yml)
- [Plans and pricing](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/plans/substack-plans-pricing.yml)
- [Conformance](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/conformance/substack-conformance.yml)
- [Packages](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/packages/substack-packages.yml)
- [Components](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/components/substack-components.yml)
- [Domain security](https://raw.githubusercontent.com/api-evangelist/substack/refs/heads/main/security/substack-domain-security.yml)

## Docs

- [Help Center](https://support.substack.com/) — note: serves an HTTP 403 Cloudflare JavaScript challenge to non-browser clients; the same content is readable from the Zendesk Help Center API at `https://support.substack.com/api/v2/help_center/en-us/articles/{id}.json`
- [Pricing: how much does Substack cost](https://support.substack.com/hc/en-us/articles/360037607131-How-much-does-Substack-cost) — publishing is free; 10% of paid-subscription transactions plus Stripe fees
- [Changelog](https://substack.com/changelog) — product changes only; no API entries
- [Status](https://status.substack.com/) — Atlassian Statuspage; machine-readable summary at https://substack.statuspage.io/api/v2/summary.json
- [Blog](https://on.substack.com/) — feed at https://on.substack.com/feed
- [Vulnerability disclosure](https://substack.com/vulnerability-disclosure)
- [Terms of Use](https://substack.com/tos) · [Privacy](https://substack.com/privacy) · [Content guidelines](https://substack.com/content)

## Not published

Substack ships none of the following, checked 2026-08-13: OpenAPI or Swagger, AsyncAPI,
GraphQL, gRPC, webhooks, a first-party SDK in any registry, a CLI, a sandbox or test
mode, an idempotency contract, a deprecation policy, an SLA, published rate-limit
values, a security.txt, an api-catalog, or an A2A agent card. Every "Substack SDK" and
every "Substack MCP server" in a public registry is third-party.