zola-api

Zola mobile API via curl (no MCP)

Zola's mobile API (mobile-api.zola.com — the same surface the iOS/iPad app and zola-mcp use) is a plain Bearer-JWT REST API reachable directly from a server or shell — no browser bridge needed. This skill shells out to curl with the JWT in an Authorization: Bearer header, exactly as zola-mcp's src/client.ts does.

One-time setup: get the refresh token

You need Zola's long-lived (~1 year) refresh JWT — the usr cookie from a signed-in zola.com session. Same credential zola-mcp uses:

# Prefer the env var zola-mcp itself reads (check its .env first):
grep -h ZOLA_REFRESH_TOKEN ~/git/zola-mcp/.env 2>/dev/null
export ZOLA_REFRESH_TOKEN='eyJhbGciOi...'   # or export directly if you have it

If you don't have it yet: sign into zola.com, open DevTools → Application → Cookies → https://www.zola.com, copy the usr value. (zola-mcp also has a fetchproxy fallback that reads this cookie from a signed-in browser tab — see its README — but that's the MCP's path, not this skill's; this skill assumes you already have the token in hand.)

Core call pattern

Every mobile-api call needs a short-lived (30 min) session token, minted from the refresh token, plus a fixed set of headers (CloudFront WAF requires x-zola-session-id on every request — omit it and you get a 403).

BASE=https://mobile-api.zola.com
DEVICE_SESSION_ID=$(uuidgen | tr 'a-z' 'A-Z')   # one per "session"; reuse across calls
UA='Zola/42.5.0 (iPad; iOS 26.4; Scale/2.0)'

# 1. Mint a 30-min session token from the refresh token
SESSION_TOKEN=$(curl -sS -X POST "$BASE/v3/sessions/refresh" \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -H "x-zola-platform-type: iphone_app" -H "x-zola-session-id: $DEVICE_SESSION_ID" \
  -H "user-agent: $UA" \
  -d "{\"token\":\"$ZOLA_REFRESH_TOKEN\"}" | jq -r '.data.session_token')

# 2. Every subsequent call reuses $SESSION_TOKEN until it expires (~30 min),
#    then re-run step 1. All calls carry the same 4 headers:
curl -sS -X GET "$BASE/v3/users/me/context" \
  -H "authorization: Bearer $SESSION_TOKEN" \
  -H "x-zola-platform-type: iphone_app" -H "x-zola-session-id: $DEVICE_SESSION_ID" \
  -H "user-agent: $UA" | jq '.data'