API & MCP server

Everything the app does can be driven from your own code or from an AI assistant. Both use the same API key, which acts as your account: the same credit pools, the same Pro workspace, the same limits, and the same charges when you generate.

API keys

Create keys at Account, API keys. A key looks like tc_live_…, is shown once, and can be revoked at any time. Send it as a Bearer token:

Authorization: Bearer tc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Up to 10 active keys per account. Name them by where they are used, so you can revoke one without touching the rest.
• A key resolves to the same user and workspace as your browser session: if you are in a Pro workspace with an active subscription, generation draws on the workspace pool; otherwise on your personal pool.
• Keys cannot create or revoke other keys. That stays in the dashboard.

Endpoints

Base URL https://trackingcoder.com. JSON in, JSON out. Errors come back as { "error": "..." } with a 4xx or 5xx status.

GET /api/scenarios

Public catalog, no key needed: every event type with its credit cost and free-plan eligibility, every channel with the ID it needs, the advanced parameters, output formats and pricing rules. Cached for an hour.

POST /api/scan

Scans a public website: CMS, builder, forms, e-commerce platform, installed analytics and pixels, page types. Returns the profile and a scanId (valid 24 hours) for generation. Works without a key too, with tighter limits.

POST /api/scan
{ "url": "https://example.com" }

200 { "scanId": "…", "profile": { "cms": "WordPress", "builder": "Elementor", "formsDetected": ["Contact Form 7"], "hasGA4": true, … }, "scanMethod": "browserless" }

POST /api/generate

Generates the tracking for one event on one channel. Spends credits: the scenario's cost (1 for most events), plus 1 per advanced parameter, plus 1 for Consent Mode v2. Free credits cover the basic events on GA4. Identical requests within two minutes return the first result without charging again.

POST /api/generate
{
  "scanId": "…",
  "scenarioName": "Form Submission",
  "channel": "ga4",
  "channelId": "G-XXXXXXXXXX",
  "outputFormat": "gtm_container",
  "discoveryAnswers": { "formPlugin": "Contact Form 7", "pageUrl": "/contact" },
  "advancedParams": ["prev_page"],
  "requireConsent": true
}

200 { "gtmContainerJson": "…", "gtmCode": "…", "code": "…", "metadata": { "eventName": "form_submission", … },
      "creditsCharged": 2, "freeCreditsUsed": 0, "newBalance": { "credits": 18, "freeCredits": 5 } }
402 { "error": "Not enough credits…" }   403 { "error": "…not included in the Free plan…", "code": "free_tier_restricted" }

• scenarioName is the event's name exactly as in the catalog; channel is ga4, meta, gads, linkedin or msads; channelIdSecondary carries the Google Ads conversion label.
• outputFormat: gtm_container (import JSON, default for the API), gtm_html (a Custom HTML snippet) or direct (a script for the page).
• discoveryAnswers are the wizard's questions, optional: elementText, pageUrl, pageSection, formPlugin, formPurpose, afterSubmit, pageScope, videoScope, paymentProvider, paymentFlow.

GET /api/credits

The balance of the active pool, plus both pools, and when free credits renew.

POST /api/tools/consent-check and POST /api/tools/track-detect

The free tools, as JSON: { "url": "…" }. The consent check returns the verdict, the six checks and the evidence; the tracking detector returns the pixels found and the core channels missing. Rate limited per caller; a key does not raise those limits.

Rate limits

• Scans: 5 a minute, 30 an hour, 100 a day with a key (anonymous: 3, 10, 20).
• Consent checks: 4 a minute, 15 an hour, 40 a day. Tracking detection: 12 a minute, 60 an hour.
• MCP calls: 60 a minute per key.

Limits answer with HTTP 429 and a Retry-After header.

The TC MCP server

The same capabilities as tools for AI assistants, through the Model Context Protocol. The server runs at https://trackingcoder.com/api/mcpover Streamable HTTP (stateless JSON), authenticated with your API key as a Bearer token.

• list_scenarios: the catalog.
• scan_site: scan a URL, get a scanId.
• generate_tracking: generate one event for one channel. Spends credits; the assistant is told to confirm with you first.
• get_credits: your balance.
• check_consent and detect_tracking: the free diagnostics.

Claude Code

claude mcp add --transport http trackingcoder https://trackingcoder.com/api/mcp --header "Authorization: Bearer tc_live_…"

Cursor, VS Code and other editors

Add a server of type HTTP (sometimes called streamable-http) with the URL above and an Authorization header:

{
  "mcpServers": {
    "trackingcoder": {
      "url": "https://trackingcoder.com/api/mcp",
      "headers": { "Authorization": "Bearer tc_live_…" }
    }
  }
}

Claude Desktop

Claude Desktop reaches remote servers through the mcp-remote bridge:

{
  "mcpServers": {
    "trackingcoder": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://trackingcoder.com/api/mcp", "--header", "Authorization: Bearer tc_live_…"]
    }
  }
}

Good to know

• A scanId is valid for 24 hours. Scanning the same URL again within that window returns the cached profile without a new browser run.
• Generation is idempotent for two minutes: a retry of the identical request returns the original result and is not charged twice.
• Nothing is published to Google Tag Manager by the API. The one-click push stays in the app, where you review the workspace before publishing.