Developer API

Quick start

Base URL:

https://mysmartcopilot.com/tool-api/v1/

POST endpoints take a JSON body (Content-Type: application/json); GET endpoints take query parameters. Responses are JSON with "ok": true on success (only qr with "format": "svg" returns the image itself), errors are JSON too, and GET /tool-api/v1/ lists all endpoints. Browsers may call the API from any site: responses carry Access-Control-Allow-Origin: * and no credentials are used.

With curl:

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/json/format \
  -H 'Content-Type: application/json' \
  -d '{"json":"{\"name\":\"MySmartCoPilot\",\"tools\":[\"json\",\"emi\"],\"free\":true}","indent":2}'

From JavaScript:

const res = await fetch('https://mysmartcopilot.com/tool-api/v1/hash', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"text":"hello world","algorithm":"sha256"}),
});
const data = await res.json();
if (!data.ok) throw new Error(data.error.message);
console.log(data.hash);

Limits and fair use

• 60 requests per minute per IP address without a key. The limit is approximate: it is counted in memory on each Cloudflare server that handles your requests. Over the limit you get 429 with a Retry-After header.
• 120 requests per minute and up to 10,000 calls per calendar month with the licence key of a Business pass in an X-Api-Key header: see Business licence keys.
• 100 KB maximum request body, plus the per-endpoint input limits listed below (they keep each request fast).
• MySmartCoPilot runs on free hosting quotas. When the daily quota is nearly used up, the API pauses automatically for every caller, with or without a key, and answers 503 until 00:00 UTC. There is no uptime guarantee.
• API keys with their own per-minute limit can also be issued by hand, free of charge, for a particular project: contact us and describe your use. Send the key in an X-Api-Key header.
• /tool-api/v1/ is stable. A breaking change would get a new version path.

Business licence keys

The licence key of a Business pass also works as an API key. Send it in the X-Api-Key header, from your own server rather than a web page: anyone who has the key can use its quota and the pass. For example, with the key in the environment variable MYSMARTCOPILOT_KEY:

curl -s -i -X POST https://mysmartcopilot.com/tool-api/v1/hash \
  -H 'Content-Type: application/json' \
  -H "X-Api-Key: $MYSMARTCOPILOT_KEY" \
  -d '{"text":"hello world","algorithm":"sha256"}'

• 120 requests a minute, counted per key: every server and address that uses the key shares them. Like the anonymous limit, it is approximate, because it is counted in memory on each Cloudflare server that handles your requests.
• Up to 10,000 calls per calendar month (UTC). Every call the key is accepted for counts, including one that the endpoint then rejects as invalid input.
• When the month’s calls are used up, you get 429 with a Retry-After header until 00:00 UTC on the 1st. Without the X-Api-Key header, the anonymous limit still applies.
• A Pro licence key gets 403: a Pro pass raises the limits of the server-side checks on the website, and API access is part of Business.
• The automatic pause described above applies to key holders too, and GET /tool-api/v1/ lists this allowance under limits.businessLicenceKey.

Answers to a valid Business key carry these headers, and browsers on other sites can read them too. 404, 405 and 503 answers have none of them: the key has not been checked by then.

A refusal for the per-minute limit comes before the month is counted, so it has X-RateLimit-* and Retry-After but no X-Quota-* headers. A refused body (400, 413, 415) has been counted, so it has them.

What the key adds, plainly: twice the anonymous rate (120 instead of 60 requests a minute), counted per licence instead of per IP address, so it works the same from serverless platforms and from shared or changing addresses, and the quota headers. It is not the only way to call the API and does not raise the total number of calls: use without a key stays open to everyone and has no monthly cap.

Privacy

Unlike the browser tools, API requests are sent to our server (Cloudflare Pages Functions). MySmartCoPilot does not store or log the text you send: it is processed in memory and discarded after the response. We keep only aggregate daily request counts to watch the free quotas (and, for API keys, the last day each key was used; for a Business licence key, the number of calls this calendar month, deleted 2 days after the month ends). Your IP address is used in memory for rate limiting only. For private data, use the browser tools — they never upload your input.

Errors

Errors use one shape everywhere. code is stable and machine-readable; message is safe to show to people. For example, an unsupported hash algorithm returns:

{
  "ok": false,
  "error": {
    "code": "invalid_input",
    "message": "Algorithm: Use one of: md5, sha1, sha256, sha384, sha512.",
    "fields": {
      "algorithm": "Use one of: md5, sha1, sha256, sha384, sha512."
    }
  }
}

Endpoints

The example responses below were produced by running the real API code when this page was built.

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/json/format \
  -H 'Content-Type: application/json' \
  -d '{"json":"{\"name\":\"MySmartCoPilot\",\"tools\":[\"json\",\"emi\"],\"free\":true}","indent":2}'

{
  "ok": true,
  "output": "{\n  \"name\": \"MySmartCoPilot\",\n  \"tools\": [\n    \"json\",\n    \"emi\"\n  ],\n  \"free\": true\n}",
  "stats": {
    "keys": 3,
    "objects": 1,
    "arrays": 1,
    "maxDepth": 2,
    "duplicateKeys": []
  }
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/json/validate \
  -H 'Content-Type: application/json' \
  -d '{"json":"{\"a\": 1,}"}'

{
  "ok": true,
  "valid": false,
  "error": {
    "message": "Trailing comma is not allowed before '}'",
    "line": 1,
    "column": 9
  }
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/text/stats \
  -H 'Content-Type: application/json' \
  -d '{"text":"MySmartCoPilot tools run in your browser. Files stay on your device!"}'

{
  "ok": true,
  "stats": {
    "words": 11,
    "characters": 68,
    "charactersNoSpaces": 58,
    "letters": 56,
    "sentences": 2,
    "paragraphs": 1,
    "lines": 1,
    "utf8Bytes": 68,
    "readingMinutes": 0.05,
    "speakingMinutes": 0.08,
    "avgWordLength": 5.09,
    "longestWord": "MySmartCoPilot"
  }
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/calc/emi \
  -H 'Content-Type: application/json' \
  -d '{"principal":500000,"annualRatePercent":9.5,"months":60}'

{
  "ok": true,
  "emi": 10500.93,
  "totalInterest": 130055.84,
  "totalPayment": 630055.84
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/hash \
  -H 'Content-Type: application/json' \
  -d '{"text":"hello world","algorithm":"sha256"}'

{
  "ok": true,
  "algorithm": "sha256",
  "encoding": "hex",
  "hash": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
}

curl -s 'https://mysmartcopilot.com/tool-api/v1/uuid?version=7&count=2'

{
  "ok": true,
  "version": 7,
  "uuids": [
    "01a10c6e-7d79-738d-8106-436fbd834079",
    "01a10c6e-7d79-738e-88f5-7225935ceda2"
  ]
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/base64/encode \
  -H 'Content-Type: application/json' \
  -d '{"text":"नमस्ते MySmartCoPilot ✓"}'

{
  "ok": true,
  "output": "4KSo4KSu4KS44KWN4KSk4KWHIE15U21hcnRDb1BpbG90IOKckw==",
  "bytes": 37
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/base64/decode \
  -H 'Content-Type: application/json' \
  -d '{"base64":"TXlTbWFydENvUGlsb3Qg4pyT"}'

{
  "ok": true,
  "text": "MySmartCoPilot ✓",
  "bytes": 18
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/url/encode \
  -H 'Content-Type: application/json' \
  -d '{"text":"price list & offers/2026?q=₹500"}'

{
  "ok": true,
  "output": "price%20list%20%26%20offers%2F2026%3Fq%3D%E2%82%B9500"
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/url/decode \
  -H 'Content-Type: application/json' \
  -d '{"text":"price%20list%20%26%20offers%2F2026%3Fq%3D%E2%82%B9500"}'

{
  "ok": true,
  "output": "price list & offers/2026?q=₹500"
}

curl -s -X POST https://mysmartcopilot.com/tool-api/v1/qr \
  -H 'Content-Type: application/json' \
  -d '{"text":"https://mysmartcopilot.com/","errorCorrection":"M"}'

{
  "ok": true,
  "svg": "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 37 37\" shape-rendering=\"crispEdges\"><path fill=\"#ffffff\" d=\"M0 0h37… (1,552 characters)"
}

Other endpoints

Paths under /api/ serve this website itself (configuration, the server-side checks of some tools, contact form, newsletter, anonymous usage counts). They only accept requests from MySmartCoPilot pages and are not part of the public API.