Music24 API

Authentication

Music24’s API is available on the Pro plan. Create a personal access token from Settings → API access in the Music24 app. The token is shown once, at creation time — Music24 stores only its hash, so write it down. You can have at most 5 active tokens; revoke one to make room for another.

Send the token on every request as an Authorization header, either scheme:

Authorization: Token m24_xxxxxxxxxxxxxxxxxxxxxxxx

Bearer works the same way as Token — both are accepted. Examples on this page use https://<music24-api-origin> as a stand-in for the Music24 API origin. Here it is against a real endpoint (see Endpoints below for the full list):

curl 'https://<music24-api-origin>/trpc/artists.topGaining?input=%7B%22json%22%3A%7B%22limit%22%3A5%7D%7D' \
  -H 'Authorization: Token m24_your_token_here'

{
  "result": {
    "data": {
      "json": {
        "artists": [
          {
            "artistMaid": "2ab91f6e-...",
            "mainArtistName": "Role Model",
            "imageUrl": "https://.../role-model.jpg",
            "addedToPlaylists": { "current": 0.42, "previous": 0.31 },
            "removedFromPlaylists": { "current": 0.02, "previous": 0.05 }
          }
        ],
        "pagination": { "limit": 5, "offset": 0 }
      }
    }
  }
}

Revoking a token from Settings → API access takes effect immediately for new requests to Music24’s own servers. The token resolution is cached for up to 5 minutes on the API layer, so a revoked token can keep working there for up to 5 minutes after you revoke it.

Endpoints

Every endpoint below is a tRPC procedure reached over plain HTTP at https://<music24-api-origin>/trpc/<router>.<procedure> — the same Music24 API origin used in Authentication above. The examples on this page use single, unbatched requests, one call per endpoint.

A query (read) is a GET request. Its arguments go in an input query parameter, as URL-encoded JSON wrapped in { "json": ... }:

GET /trpc/artists.topGaining?input=%7B%22json%22%3A%7B%22limit%22%3A5%7D%7D

That decodes to an input of:

{ "json": { "limit": 5 } }

A mutation (write — follow / unfollow) is a POST request instead, with the same { "json": ... } shape as the request body and Content-Type: application/json.

Every response is wrapped the same way: { "result": { "data": { "json": ... } } }. A failed call returns a non-2xx status with { "error": { "message": ..., "code": ... } }.

curl 'https://<music24-api-origin>/trpc/playlists.trending?input=%7B%22json%22%3A%7B%22limit%22%3A3%7D%7D' \
  -H 'Authorization: Token m24_xxxxxxxxxxxxxxxxxxxxxxxx'

{
  "result": {
    "data": {
      "json": {
        "playlists": [
          {
            "playlistId": "b6b6a1e2-...",
            "name": "Rap Caviar",
            "curatorName": "Spotify",
            "followersGain": 18420,
            "position": 1,
            "integrationType": "spotify"
          }
        ],
        "pagination": { "offset": 0, "limit": 3 }
      }
    }
  }
}

curl 'https://<music24-api-origin>/trpc/artists.details?input=%7B%22json%22%3A%7B%22artistId%22%3A%222ab91f6e-...%22%7D%7D' \
  -H 'Authorization: Token m24_xxxxxxxxxxxxxxxxxxxxxxxx'

{
  "result": {
    "data": {
      "json": {
        "maid": "2ab91f6e-...",
        "mainName": "Role Model",
        "imageUrl": "https://.../role-model.jpg"
      }
    }
  }
}

curl 'https://<music24-api-origin>/trpc/artists.followedArtists?input=%7B%22json%22%3A%7B%22limit%22%3A10%7D%7D' \
  -H 'Authorization: Token m24_xxxxxxxxxxxxxxxxxxxxxxxx'

{
  "result": {
    "data": {
      "json": {
        "artists": [
          { "id": 501, "maid": "2ab91f6e-...", "mainName": "Role Model", "imageUrl": "https://.../role-model.jpg" }
        ],
        "total": 37,
        "hasMore": true
      }
    }
  }
}

curl 'https://<music24-api-origin>/trpc/insights.trendingUp?input=%7B%22json%22%3A%7B%22entityType%22%3A%22artist%22%2C%22limit%22%3A3%7D%7D' \
  -H 'Authorization: Token m24_xxxxxxxxxxxxxxxxxxxxxxxx'

{
  "result": {
    "data": {
      "json": {
        "rows": [
          {
            "date": "2026-08-28",
            "entityType": "artist",
            "id": "2ab91f6e-...",
            "name": "Role Model",
            "value": 41200,
            "pctChange7d": 0.18,
            "pctChange30d": 0.44
          }
        ],
        "hasMore": false
      }
    }
  }
}

MCP (for AI clients)

Music24 runs a remote MCP server at https://<music24-api-origin>/mcp (Streamable HTTP) — the Music24 API origin, same as in Authentication above. Point any MCP-compatible client — Claude, Cursor, or your own agent — at that URL and it connects with OAuth, not a personal access token. This also requires the Pro plan.

The client discovers how to sign the user in on its own, following two well-known endpoints:

GET https://<music24-api-origin>/.well-known/oauth-protected-resource
  → points to the authorization server:
GET https://api.freeyourmusic.com/.well-known/oauth-authorization-server

From there the client registers itself (RFC 7591, no manual setup), then runs the standard authorization-code + PKCE (S256) flow, requesting scope music24:read. A successful flow returns an access token good for 1 hour and a refresh token good for 30 days (rotating on use — the old refresh token stops working the moment a new one is issued).

Log in to Music24 in your browser before connecting an MCP client. The consent screen that approves the connection needs an existing Music24 session. If you get signed out mid-flow, log back in and retry the connection.

Tools

• music24_top_artists — Top artists on Music24's chart, overall or gaining.
• music24_top_tracks — Top tracks on Music24's chart, overall or gaining.
• music24_artist_details — An artist's profile plus playlist-addition and visibility stats.
• music24_track_details — A track's profile plus playlist-addition and visibility stats.
• music24_my_follows — The caller’s followed artists, tracks, and playlists.
• music24_daily_report — Daily digest for the caller's follows, today vs. yesterday.
• music24_weekly_report — Weekly digest for the caller's follows, this week vs. last.
• music24_playlist_changes — Recent track add/remove events for one playlist, by id.

music24_playlist_changes is scoped to one playlist you give it by id — it is not a feed across every playlist you follow. Use music24_my_follows to get the list of playlists to ask about.

Limits

• Plan. Personal access tokens and MCP/OAuth both require the Music24 Pro plan. A token or OAuth client on any other plan is rejected.
• Rate limit. 30 requests per minute per user, whether you call the tRPC endpoints directly or through an MCP tool — the two share the same limit.
• History window. How far back date can go, and how deep offset pagination can reach, both depend on your plan. Asking for a date or offset beyond your plan’s limit returns a FORBIDDEN error naming the limit you hit.
• Browse credits. Looking up details for an artist, track, or playlist you don’t already follow spends one of your plan’s daily browse credits. Anything you follow is free to browse as often as you like.
• Revocation. Revoking a personal access token takes effect immediately against Music24’s own servers, and within 5 minutes against the API layer that actually serves these endpoints (it caches token lookups for 5 minutes). An OAuth access token simply expires after 1 hour; revoke the connection from Settings to invalidate its refresh token sooner.