API Overview
The MyTCRPlus API provides programmatic access to our comprehensive suite of TCPA and TCR (10DLC) compliance tools. Built for enterprises, compliance teams, and developers who need to validate brand information, messaging content, and ensure regulatory compliance for SMS campaigns.
Base URL
https://api.mytcrplus.com/v1
Key Features
Secure token-based auth with 30-day expiration
Brand validation, message checking, ROI analysis
1 token per tool use, daily free token available
Rate limiting, CORS, comprehensive security
JSON responses, standard HTTP methods
Automatic token provisioning via webhooks
API Capabilities
- Brand Validation - Verify EIN, legal name, domain, and business information
- Carrier Compliance - Scan carrier-specific requirements and rules
- Consent Validation - Ensure proper consent mechanisms and language
- Message Analysis - Validate SMS content for TCPA compliance
- Document Generation - Create compliance documentation
- Error Diagnostics - Decode TCR error codes and rejection reasons
- ROI Analysis - Calculate build vs buy cost comparisons
- Trust Scoring - Assess brand trust factors for registration
Quick Start Guide
Get started with the MyTCRPlus API in 3 simple steps:
Step 1: Register an Account
You'll receive 2 free trial tokens immediately
Step 2: Login to Get JWT Token
Save the returned token for subsequent requests
Step 3: Use a Compliance Tool
This will consume 1 token and return compliance results
Free Daily Token
Every user gets 1 free token per day! Check /v1/tokens/check-daily-free to see if yours is available.
Authentication
All API requests (except registration, login, and health check) require a valid JWT token. Tokens are issued upon successful login and must be included in the Authorization header.
Request Header Format
Token Specifications
| Property | Value | Description |
|---|---|---|
Algorithm |
HS256 | HMAC with SHA-256 |
Expiration |
30 days | Configurable via JWT_EXPIRY |
Payload |
userId, email, iat, exp | User identification and timestamps |
Storage |
Client-side | Stateless authentication |
Password Requirements
- Minimum 8 characters, maximum 72 characters
- At least one uppercase letter (A-Z)
- At least one lowercase letter (a-z)
- At least one number (0-9)
- At least one special character (!@#$%^&*)
Security Best Practices
- Never expose JWT tokens in client-side code or public repositories
- Store tokens securely (HttpOnly cookies or secure storage)
- Implement token refresh logic before 30-day expiration
- Use HTTPS for all API communications
- Passwords are hashed with Argon2id (64MB memory, 4 iterations)
Authentication Endpoints
/v1/auth/register
Register a new user account. Automatically grants 2 free trial tokens upon successful registration.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
email |
string | Required | Valid email address (must be unique) |
password |
string | Required | Must meet password requirements |
firstName |
string | Required | User's first name (max 50 chars) |
lastName |
string | Optional | User's last name (max 50 chars) |
Response (201 Created)
Error Responses
400- Invalid email format or password doesn't meet requirements409- Email already registered429- Rate limit exceeded (3 attempts per 15 minutes)
/v1/auth/login
Authenticate with existing credentials and receive a JWT token valid for 30 days.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
email |
string | Required | Registered email address |
password |
string | Required | User password |
Response (200 OK)
Error Responses
400- Missing email or password401- Invalid credentials or account locked429- Rate limit exceeded (5 attempts per 15 minutes)
After 5 failed login attempts, the account is locked for 30 minutes.
/v1/auth/verify
Auth Required
Verify that your JWT token is valid and retrieve current user information.
Headers Required
Response (200 OK)
Error Responses
401- Missing, invalid, or expired token
/v1/auth/logout
Auth Required
Logout endpoint for client-side token cleanup. Since authentication is stateless (JWT), this endpoint simply confirms the request. Clients should delete the stored token.
Response (200 OK)
/v1/auth/forgot-password
Request a password reset token. An email will be sent with reset instructions (email functionality pending implementation).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
email |
string | Required | Registered email address |
Response (200 OK)
Reset tokens expire after 1 hour and can only be used once.
/v1/auth/reset-password
Reset password using the token received via email.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
token |
string | Required | Reset token from email |
newPassword |
string | Required | New password (must meet requirements) |
Response (200 OK)
Error Responses
400- Invalid token, expired token, or password doesn't meet requirements429- Rate limit exceeded (3 attempts per 15 minutes)
Token Management
Manage your usage tokens. Each compliance tool costs 1 token per use. Purchase tokens at mytcrplus.com/pricing
/v1/tokens/balance
Auth Required
Get current token balance and daily free token availability.
Response (200 OK)
Response Fields
| Field | Type | Description |
|---|---|---|
balance |
integer | Current token count |
trialTokensUsed |
boolean | Whether trial tokens were granted |
hasDailyFree |
boolean | Whether daily free token is available today |
/v1/tokens/check-daily-free
Auth Required
Check if the daily free token is available (without claiming it).
Response (200 OK)
/v1/tokens/use
Auth Required
Manually deduct tokens (typically called internally by tool endpoints).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
toolName |
string | Required | Name of the tool being used |
amount |
integer | Optional | Number of tokens (default: 1) |
Response (200 OK)
Error Responses
402- Insufficient tokens (need to purchase more)
/v1/tokens/history?limit=50&offset=0
Auth Required
Get paginated transaction history with all token activities.
Query Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
limit |
integer | 50 | Number of records (max 100) |
offset |
integer | 0 | Pagination offset |
Response (200 OK)
Transaction Types
trial- Initial 2 free tokens on registrationpurchase- Tokens purchased via WooCommercedaily_free- Daily free token grantusage- Token used for a tool (negative amount)refund- Token refunded
Token Packages Available
- Trial: 2 tokens (free on registration)
- Daily Free: 1 token per day (automatically available)
- 10 Tokens: Purchase at mytcrplus.com
- 20 Tokens: Purchase at mytcrplus.com
- 50 Tokens: Purchase at mytcrplus.com
- 100 Tokens: Purchase at mytcrplus.com
Compliance Tools (12 Tools)
Each tool endpoint requires authentication and consumes 1 token per request (unless using daily free token). All tools accept POST requests with JSON bodies and return detailed compliance analysis.
/v1/tools/brand-checker
Auth Required
1 Token
Validates brand information for TCR registration compliance. Checks EIN format, legal name, domain ownership, and business entity details.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
ein |
string | Required | Employer Identification Number (format: 12-3456789) |
legalName |
string | Required | Legal business name |
websiteDomain |
string | Required | Company website domain |
state |
string | Required | State of registration (2-letter code) |
dbaName |
string | Optional | Doing Business As name |
businessType |
string | Optional | corporation, llc, partnership, sole_proprietor, non_profit |
Response (200 OK)
/v1/tools/message-validator
Auth Required
1 Token
Validates SMS/MMS message content for TCPA compliance. Checks length, opt-out language, prohibited content, and segment count.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
message |
string | Required | SMS message text to validate |
messageType |
string | Optional | promotional, transactional, conversational |
Response (200 OK)
/v1/tools/carrier-scanner
Auth Required
1 Token
Scans carrier-specific requirements and rules for major US carriers (Verizon, AT&T, T-Mobile, etc.).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
carriers |
array | Optional | Specific carriers to check (or all if omitted) |
useCase |
string | Optional | Campaign use case type |
/v1/tools/consent-validator
Auth Required
1 Token
Validates consent mechanisms and language for TCPA compliance. Ensures proper express written consent.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
consentText |
string | Required | Consent language to validate |
consentMethod |
string | Optional | checkbox, signature, web_form, sms_optin |
/v1/tools/roi-calculator
Auth Required
1 Token
Calculate ROI comparing build vs buy for compliance platform. Includes development costs, timeline, and opportunity costs.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
campaignCount |
integer | Required | Number of campaigns to manage |
brandCount |
integer | Required | Number of brands |
launchTimeline |
integer | Required | Desired launch timeline (months) |
devRate |
number | Optional | Developer hourly rate (default: 150) |
complianceRate |
number | Optional | Compliance expert rate (default: 200) |
Response (200 OK)
/v1/tools/trust-score
Auth Required
1 Token
Calculate trust score for TCR brand registration based on business verification factors.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
yearsInBusiness |
integer | Required | Years company has been operating |
hasDUNS |
boolean | Required | Has D-U-N-S number |
hasDomain |
boolean | Required | Has registered domain |
domainAge |
integer | Optional | Domain age in years |
hasPhysicalAddress |
boolean | Optional | Has verified physical address |
hasPrivacyPolicy |
boolean | Optional | Has published privacy policy |
hasTermsOfService |
boolean | Optional | Has published terms of service |
previousCompliance |
boolean | Optional | Previous compliance history |
Response (200 OK)
/v1/tools/error-diagnostic
Auth Required
1 Token
Diagnose TCR error codes and get detailed explanations with resolution steps.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
errorCode |
string | Required | TCR error code or message |
context |
string | Optional | Additional error context |
/v1/tools/rejection-decoder
Auth Required
1 Token
Decode campaign or brand rejection reasons with actionable remediation steps.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
rejectionReason |
string | Required | Rejection reason text |
entityType |
string | Optional | brand or campaign |
/v1/tools/document-generator
Auth Required
1 Token
Generate compliance documentation templates (privacy policies, consent forms, terms of service).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
documentType |
string | Required | privacy_policy, terms_of_service, consent_form |
companyName |
string | Required | Company name for document |
additionalInfo |
object | Optional | Additional customization data |
/v1/tools/provider-checklist
Auth Required
1 Token
Get provider-specific requirements checklist for major messaging platforms (Twilio, Bandwidth, Sinch, etc.).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
provider |
string | Required | twilio, bandwidth, sinch, telnyx, vonage |
useCase |
string | Optional | Campaign use case type |
/v1/tools/use-case-selector
Auth Required
1 Token
Recommend the appropriate TCR use case based on campaign characteristics and messaging patterns.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
campaignDescription |
string | Required | Description of campaign purpose |
messageVolume |
string | Optional | low, medium, high, very_high |
hasAffiliates |
boolean | Optional | Whether campaign uses affiliates |
/v1/tools/sanitize
Auth Required
1 Token
Sanitize and validate various data types (HTML, email, URL, phone numbers).
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
type |
string | Required | escapeHTML, sanitizeEmail, sanitizeURL, sanitizePhone |
input |
string | Required | Data to sanitize |
Response (200 OK)
Common Tool Response Fields
All tool responses include these standard fields:
success- Boolean indicating successtool- Tool identifiertokenUsed- Whether a token was consumedbalanceAfter- Remaining token balanceresults- Tool-specific results object
Webhooks
The API supports WooCommerce webhooks for automatic token provisioning when customers purchase token packages.
/v1/webhooks
WooCommerce order webhook endpoint for automatic token grants.
Supported Topics
order.updated- Triggered when order status changes to completed/processing
Security
- HMAC SHA-256 signature verification
- Timing attack prevention with hash_equals
- Payload validation
Token Product IDs
| Product ID | Package | Tokens Granted |
|---|---|---|
6566 |
Single Token | 1 |
6554 |
Subscription 10 | 10 |
6555 |
Subscription 20 | 20 |
6556 |
Subscription 50 | 50 |
6557 |
Subscription 100 | 100 |
Webhook Configuration
Configure your WooCommerce webhook to point to https://api.mytcrplus.com/v1/webhooks
with the secret key matching your WC_WEBHOOK_SECRET environment variable.
Security Features
The MyTCRPlus API implements comprehensive security measures to protect user data and prevent abuse.
Authentication & Authorization
- JWT-based stateless authentication
- HS256 algorithm with secure secret key
- 30-day token expiration
- Token verification on protected endpoints
Password Security
- Argon2id hashing (memory-hard)
- 64MB memory cost, 4 iterations
- Strong password requirements enforced
- Account lockout after 5 failed attempts
Data Protection
- SQL injection prevention (PDO prepared statements)
- XSS protection via Content-Security-Policy
- CORS protection with allowed origins
- Timing attack prevention (hash_equals)
HTTP Security Headers
- Strict-Transport-Security (HSTS)
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- X-XSS-Protection: 1; mode=block
Production Security Checklist
- All communications over HTTPS
- Environment variables stored securely (.env never committed)
- Database credentials rotated regularly
- JWT secret key is cryptographically random (64 characters)
- Rate limiting enabled on all endpoints
- Failed login tracking and account lockout
Error Handling
All errors return appropriate HTTP status codes with a JSON error response.
Error Response Format
HTTP Status Codes
Common Error Examples
Invalid JWT Token
Insufficient Tokens
Validation Error
Rate Limit Exceeded
Rate Limiting
API requests are rate-limited by IP address to prevent abuse and ensure fair usage. Rate limits vary by endpoint type.
Rate Limit Configuration
| Endpoint Type | Max Requests | Time Window | Tracking |
|---|---|---|---|
| General API | 20 | 15 minutes | By IP address |
| Login | 5 | 15 minutes | By IP address |
| Registration | 3 | 15 minutes | By IP address |
| Password Reset | 3 | 15 minutes | By IP address |
Rate Limit Response
When rate limit is exceeded, you'll receive a 429 Too Many Requests response:
Account Lockout Policy
After 5 failed login attempts, accounts are locked for 30 minutes to prevent brute force attacks.
- Tracks failed attempts by email address and IP
- 30-minute automatic unlock
- Manual unlock via password reset