Document verification, inside your product.

1. Create a workspace: Free includes 3,000 API + MCP requests and 100 file registrations per UTC calendar month. Upgrade or buy extra registrations in Billing; a success redirect alone never grants paid access.
2. Create a server-side key with verify:read in API and MCP · Español.
3. Use a real certificate, issued after review and approval. A random file has no approved reference.
4. Download the SDK and install the tarball: npm install ./checkthisfile-0.2.0.tgz. It is not yet published on npm.
5. Set CHECKTHISFILE_BASE_URL to your origin, e.g. https://checkthisfile.com, without /api/v1. Keep the key in your server's secret store.

import { readFile } from 'node:fs/promises';
import { CheckThisFile } from 'checkthisfile';

const ctf = new CheckThisFile({
  baseUrl: process.env.CHECKTHISFILE_BASE_URL,
  apiKey: process.env.CHECKTHISFILE_API_KEY,
});

const result = await ctf.verifyBytes({
  publicId: process.env.CHECKTHISFILE_CERTIFICATE_ID,
  bytes: await readFile('./approved-document.pdf'),
});

if (result.verified) {
  // Exact approved bytes. Valid and current certificate.
}

Node.js 22+, ESM, no runtime dependencies. verifyBytes calculates SHA-256 locally and sends only the hash. Alternatively use verifyHash, REST, or the Python example.

The workspace currently uses Spanish. This website, public verification and integration documentation support English.

{
  "data": {
    "verified": true,
    "hashMatches": true,
    "signatureValid": true,
    "certificateCurrent": true,
    "certificateStatus": "valid",
    "reason": "MATCH",
    "documentUploaded": false
  },
  "error": null,
  "meta": {}
}

Use data.verified === true. A matching hash alone is not enough: revoked or superseded certificates fail. This is an illustrative excerpt, not live evidence.

HASH_MISMATCH

The submitted hash differs. Metadata-only changes count too.

CERTIFICATE_NOT_CURRENT / SIGNATURE_INVALID

Do not accept it as a current verified certificate.

CERTIFICATE_NOT_FOUND

HTTP 404 with a negative result in data and error:null. The SDK returns this result.

Operational errors

401, 403, 429, network failures and timeouts are not evidence that a document changed. The SDK throws CheckThisFileError with code/status/retryAfter.

Matching bytes do not prove authorship, truth, possession, independent review or email delivery. The server validates its signed record; the SDK is not an independent offline signature verifier.

Registration, versions, analysis, declared reviews, explicit approval, certificate issuance/download/revocation, organisation audit and metrics. Private data is organisation-bound; scopes cannot elevate the actor's role.

All fields and endpoint schemas are in OpenAPI. The complete guide lists implemented operations, roles, quotas and recipes. Future endpoints are explicitly marked; do not invoke those as existing features.

Business writes need an explicit Idempotency-Key. The SDK never approves automatically. A timed-out write may have committed: inspect the document and reconcile. There is a documented commit/cache failure window, not an exactly-once promise.

Endpoint: https://checkthisfile.com/api/v1/mcp. Stateless Streamable HTTP with JSON responses. Protocol revisions: 2025-11-25, 2025-06-18, 2025-03-26. Bearer headers required. Optional external-provider OAuth requires configured identity bindings and the user's explicit consent.

{
  "mcpServers": {
    "checkthisfile": {
      "url": "https://checkthisfile.com/api/v1/mcp",
      "headers": {
        "Authorization": "Bearer <server-side API key>"
      }
    }
  }
}

Conceptual configuration: secret references and format depend on your client. Do not paste credentials into shared configuration or assume compatibility with OAuth-only connectors.

• verificar_documento: hash, signature and current status.
• verificar_certificado: public certificate summary.
• listar_documentos: own documents, if scope allows.
• consultar_consumo: plan and quota.

Read-only and scope-filtered. No review, approval or issuance tools. Give your agent the integration skill and documentation index.