API & AI access

Everything TLDTrack knows about your portfolio, uptime, SSL, DNS, security findings, email deliverability, clients and time, can be read by your own scripts and by AI assistants. A read-only API and an MCP connector let you pull that data into a dashboard, a report, or a conversation with an AI agent, without ever risking a change to your account.

API keys

An API key is a secret string that begins tldt_live_. You create one from your account settings (an admin on the organisation can do this), give it a name so you remember what it is for, and copy it once. For security we only ever store a hash of the key, so it is shown to you a single time at creation and cannot be retrieved again. If you lose it, or it leaks, revoke it and create a new one; revoking takes effect immediately.

You authenticate every request by sending the key as a bearer token: Authorization: Bearer tldt_live_.... Requests are rate limited (120 per minute per key, with a wider per-IP ceiling), which is plenty for reporting and automation.

What the REST API exposes

The API is organised around your domains, with agency data alongside. Every endpoint returns JSON under a data key and supports paging. The main resources:

• Domains. List all domains, fetch a single one by id or hostname, and read its service monitors and its key contacts.
• Per-domain checks. Security scans and their findings, email deliverability tests, PageSpeed runs, visual monitors, content monitors, brand checks and compliance checks.
• Alerts. The alerts raised across your portfolio.
• Agency data. Clients (and a single client), tasks, time entries, services, and client requests.

The full endpoint reference, with paths, parameters and response shapes, lives in the API documentation.

MCP for AI agents

MCP (the Model Context Protocol) is the standard that AI assistants use to connect to outside tools and data. TLDTrack runs an MCP server so you can add it as a connector in an assistant that supports them, and then ask questions in plain language. The assistant calls read-only tools such as:

• portfolio_summary and list_domains (filter by expiry window, status, or a search term).
• get_domain for the full record of one domain.
• list_alerts by severity or date.
• get_security_findings, get_email_deliverability, get_visual_changes, get_brand_check and get_compliance_checks for a given domain.
• For agencies: list_clients, get_client, list_tasks and get_time_summary.

You can connect the MCP server two ways: with an API key as the bearer token, or through the built-in OAuth flow that connectors use, where you approve the connection from your logged-in account rather than pasting a key. Either way the assistant only ever reads, and only within your organisation.

Getting started

1. 1
   Make sure you are on a paid plan; API and MCP access require an active paid subscription and are not available on the free tier.
2. 2
   Go to Settings → API & AI access and create a key. Copy it immediately and store it safely.
3. 3
   For scripts: call the API with Authorization: Bearer <your key> and start with the domains endpoint. See the API docs for the full list.
4. 4
   For an AI assistant: add TLDTrack as an MCP connector, then either paste an API key or complete the OAuth approval from your account. Ask it about your portfolio and it will fetch live answers.
5. 5
   Manage everything from the same settings screen: revoke a key, or revoke a connected app, whenever you need to.

Where to set this up

Good to know

• Both the API and MCP are read-only and scoped to your organisation.
• Keys are shown once and stored only as a hash; revoking is instant.
• Requests are rate limited per key (120/min) so automation stays within safe bounds.
• MCP connects with either an API key or an OAuth approval, and you can revoke a connected app from settings.
• Access requires an active paid plan; the free tier cannot use the API or MCP.