API & MCP for Developers and AI Agents

Step 1

Your license key is the API key

There is no separate token to generate. Subscribe to Pro, copy the license key from your Gumroad receipt, and send it as a Bearer token. The same key unlocks the website and the API, and it works on every device you own.

Step 2

Add the MCP server

textsharenow-mcp is a local stdio MCP server. It talks to the TextShareNow API with your key and exposes four tools to the agent. Requires Node 18 or newer.

opencode

Add this to ~/.config/opencode/opencode.json (or a project-level opencode.json):

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "textsharenow": {
      "type": "local",
      "command": ["npx", "-y", "textsharenow-mcp@latest"],
      "enabled": true,
      "environment": {
        "TEXTSHARENOW_LICENSE_KEY": "YOUR-LICENSE-KEY"
      }
    }
  }
}

Claude Code

claude mcp add textsharenow \
  --env TEXTSHARENOW_LICENSE_KEY=YOUR-LICENSE-KEY \
  -- npx -y textsharenow-mcp@latest

Claude Desktop and Cursor

Both use an mcpServers block. For Claude Desktop, edit claude_desktop_config.json; for Cursor, use .cursor/mcp.json.

{
  "mcpServers": {
    "textsharenow": {
      "command": "npx",
      "args": ["-y", "textsharenow-mcp@latest"],
      "env": {
        "TEXTSHARENOW_LICENSE_KEY": "YOUR-LICENSE-KEY"
      }
    }
  }
}

What the agent can do

Package: textsharenow-mcp · Set TEXTSHARENOW_API_BASE only if you self-host the API.

Step 3

Or call the HTTP API

Every endpoint is the same one the website uses. Send Authorization: Bearer <license-key> for Pro limits; omit it for free-plan limits. Retrieving and peeking need no auth — the code itself is the capability.

Create a share

export TSN_KEY="YOUR-LICENSE-KEY"

curl -X POST https://www.textsharenow.com/api/share \
  -H "Authorization: Bearer $TSN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"hello from the API","ttl":600,"maxReads":5}'

{
  "code": "K7Q2P",
  "ttl": 600
}

The share opens at https://www.textsharenow.com/r?code=K7Q2P.

Request body

• text — required, up to 100,000 characters on Pro (10,000 free).
• ttl — seconds: 600, 1800, 3600 on free; Pro adds 86400, 604800, 2592000, or 0 (never). Default 600.
• maxReads — 1, 5, 10, or 0 (unlimited). Pro only. Default 1.
• customCode — 3–30 characters (letters, numbers, - and _). Pro only.
• passwordHash — Pro only; a PBKDF2 verifier in the form p2$210000$<salt-hex>$<derived-hex>. (The browser's private mode uses a p3 verifier for zero-knowledge shares — p3 is not needed for API shares.)

Read, peek, delete

# Read — consumes one read
curl https://www.textsharenow.com/api/share/K7Q2P

# Peek — no read consumed, no content returned
curl https://www.textsharenow.com/api/share/K7Q2P/meta

# Delete — only shares created with the same license key
curl -X DELETE https://www.textsharenow.com/api/share/K7Q2P \
  -H "Authorization: Bearer $TSN_KEY"

Reading returns {"text":"…","readsLeft":4}. Peeking returns expiry, read counts, and whether a password is required. Deleting returns {"ok":true}.

Passwords

Plaintext passwords never reach the server. Derive the hash client-side with PBKDF2-HMAC-SHA256 (210,000 iterations, a random 16-byte salt, 32-byte output), then send it at creation:

import { pbkdf2Sync, randomBytes } from "node:crypto";

const salt = randomBytes(16).toString("hex");
const derived = pbkdf2Sync(password, Buffer.from(salt, "hex"), 210000, 32, "sha256").toString("hex");
const passwordHash = `p2$210000$${salt}$${derived}`;

A read without a password returns 401 with the salt and iteration count. Derive the same value and retry with the x-share-password header — not the URL, so the verifier never lands in access logs:

curl https://www.textsharenow.com/api/share/K7Q2P \
  -H "x-share-password: $PASSWORD_HASH"

The MCP server does this for you.

Step 4

Limits, errors, and safety

The API is intentionally small and bounded. Shares behave exactly like website shares: same expiry, same read limits, same password rules, same auto-deletion.