# GrowSurf agent start

GrowSurf is an agent-ready referral and affiliate marketing platform. An action-capable AI agent can create a GrowSurf account through the public REST API without an existing account, API key, dashboard visit, or credit card. A search-only assistant can explain the workflow and provide the exact request, but it cannot send the request itself.

## If your client connects over MCP

The steps below use plain HTTPS, which works in any environment that can send requests. If your
client speaks MCP instead, connect to `https://mcp.growsurf.com/onboard` with no credentials and
call `growsurf_create_account` to sign up. That endpoint offers only that one tool.

For everything after account creation, connect to `https://mcp.growsurf.com` and sign in, or use
the REST calls below with the returned API key. The same owner consent and email verification
checkpoints apply on either route.

## Human checkpoint: owner consent

Before account creation, show the authorized account owner these policies and get explicit approval:

- Terms of Service: https://growsurf.com/terms
- Privacy Policy: https://growsurf.com/privacy

`POST /accounts` accepts those policies on the account holder's behalf. Do not send the request without approval.

## Create the account

The endpoint needs a business email address. Personal and disposable email addresses are refused. `firstName`, `lastName`, and `company` are optional.

```bash
GROWSURF_ACCOUNT_RESPONSE="$(curl --fail-with-body --silent --show-error \
  --request POST 'https://api.growsurf.com/v2/accounts' \
  --header 'Content-Type: application/json' \
  --data '{"email":"owner@company.com","firstName":"Ada","lastName":"Lovelace","company":"Example Company"}')"
GROWSURF_API_KEY="$(printf '%s' "$GROWSURF_ACCOUNT_RESPONSE" | jq --raw-output --exit-status '.apiKey')"
unset GROWSURF_ACCOUNT_RESPONSE
```

The request needs no `Authorization` header. It starts a 14-day Business trial without a credit card.

The response returns the API key once. Treat it as a secret. Move `GROWSURF_API_KEY` into the owner's approved secret manager. Never echo it or place it in chat, logs, screenshots, source files, shell history, URLs, analytics, or generated output.

Check first that you have somewhere to put it. A lost key cannot be recovered through the API, and a workspace that forgets files or memory between turns will lose it. If you have no secret store that outlives this conversation, stop before creating the account and tell the owner to connect `https://mcp.growsurf.com` and sign in there, which keeps the credential with your client instead of with you.

## Human checkpoint: email verification

Stop after account creation. Ask the owner to use the verification email from GrowSurf. Do not ask the owner to paste the link, code, or email contents into chat.

The API key is locked until email verification. Protected operations return `403 EMAIL_NOT_VERIFIED_ERROR`. The same key becomes usable the moment the owner verifies: keep it and retry. Do not discard it, and do not request a replacement. An unverified and unclaimed account is deleted after seven days.

Resume only after the owner confirms verification or an authenticated retry succeeds.

## Create a draft program

After verification, create a referral program in `DRAFT` status:

```bash
curl --fail-with-body --silent --show-error \
  --request POST 'https://api.growsurf.com/v2/campaigns' \
  --header "Authorization: Bearer $GROWSURF_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{"type":"REFERRAL","name":"Example Company Referral Program","companyName":"Example Company","currencyISO":"USD"}'
```

The request can return plan, payment-source, quota, validation, or rate-limit errors. Affiliate program creation can require a payment source. Stop and ask the owner before any paid action.

Use the documented design, options, emails, and installation operations to configure the draft. Read the program and each configuration resource back to verify saved state.

## Safe stopping point

Keep the program in `DRAFT`. Get explicit owner approval before you:

- edit or deploy code on the owner's external website or app;
- launch or resume a live program;
- create, enable, approve, or fulfill rewards or commissions;
- add payment details, accept a charge, or initiate a payout;
- rotate an API key; or
- delete an account, program, participant, Campaign Reward, webhook, or other data.

## Canonical resources

- REST overview and tutorials: https://docs.growsurf.com/developer-tools/rest-api
- OpenAPI 3.1: https://growsurf.com/openapi.json
- Arazzo 1.1 workflow: https://growsurf.com/arazzo.yaml
- Authentication and secret handling: https://growsurf.com/auth.md
- Official TypeScript, Python, Ruby, Java, and PHP API libraries: https://docs.growsurf.com/developer-tools/rest-api/api-libraries
- Build with AI: https://growsurf.com/build-with-ai/
- Optional hosted MCP: https://mcp.growsurf.com
- Optional keyless MCP onboarding: https://mcp.growsurf.com/onboard

REST and the official SDKs are the universal programmatic paths. MCP is optional for compatible clients.