The KT8 Tools API

Get started

KT8 Tools is invite only for now, and so is the API. Once you have an invite:

1. Sign in at kt8.com/account and open API keys.
2. Give the key a name, choose Make a key, and copy it. It's shown once.
3. Send the key with each request, in an Authorization header:

curl https://kt8.com/api/tools/me \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

If the key is good you'll see your email address and "allowed": true. Every request and answer is JSON, and every address starts with https://kt8.com.

API keys

• One key works in every tool. You can have up to 5, so make one for each script or server, and delete any you no longer use.
• A key acts as you. Anything it runs counts towards your daily limits, the same as using the tools on our pages.
• We keep only a fingerprint of each key (a SHA-256 hash), so we can't show it again. Lost a key? Delete it and make a new one.
• Send keys in the Authorization: Bearer header or an X-API-Key header, never in the web address. Keep them on your server, not in a web page.
• Deleting a key, or your account, stops it working straight away.

Every tool at a glance

Speed test

Start a test, then ask for it every few seconds until status is done or failed. Most tests take about 30 seconds.

curl -X POST https://kt8.com/tools/speed/api/tests \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••" \
  -H "Content-Type: application/json" \
  -d '{"url":"example.co.uk","device":"mobile","connection":"4g","region":"uk"}'

{"ok":true,"id":"Hk3mPq7xYz"}

curl https://kt8.com/tools/speed/api/tests/Hk3mPq7xYz

The finished test has a report with the grade, scores, Core Web Vitals (timings), every request, and the checks list of what to fix. Anyone with the report's address can open it at kt8.com/tools/speed/r/<id>, so there's no key needed to read one. Tests are kept for 30 days.

DNS checker

curl "https://kt8.com/api/tools/dns?domain=example.co.uk" \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

The answer has the domain's score, every check with its plain-English fix, blocklist results and a reportId. Add &selector=google to check a particular DKIM key. To look up one record from three public resolvers, use GET /api/tools/dns/lookup?name=example.co.uk&type=MX. To get a link you can share, POST /api/tools/dns/<reportId>/share.

Mail tester

Ask for a test address, send an email to it within 30 minutes, then ask for the result.

curl -X POST https://kt8.com/api/tools/mail-test/new \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

{"id":"a1b2c3d4e5","address":"a1b2c3d4e5@test.kt8.com","expiresAt":"2026-10-18T13:30:00Z"}

curl https://kt8.com/api/tools/mail-test/a1b2c3d4e5 \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

status is waiting until the email arrives, then done with the report (the score out of 10, what cost points, and how to fix each one), or expired. headers holds the email’s headers exactly as they arrived (we never keep its text or attachments). POST /api/tools/mail-test/<id>/share makes a share link. Reports are kept for 7 days.

Mail tester in your AI assistant

Claude, ChatGPT and other assistants that support MCP can run the mail tester for you: they get a test address, you send your email to it, and they read the report and explain what to fix. Add this server with your API key:

https://kt8.com/api/tools/mcp
Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••

In Claude Code, that’s one line:

claude mcp add --transport http kt8-tools https://kt8.com/api/tools/mcp \
  --header "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

It has three tools: mail_test_new_address, mail_test_report (waits up to 25 seconds for the email to arrive) and mail_test_headers. Tests made this way count towards the same 10 a day.

Link Inspector

curl -X POST https://kt8.com/api/tools/link-check/start \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.co.uk/"}'

curl https://kt8.com/api/tools/link-check/<id> \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

Link Inspector checks every page of websites you've proved are yours (on the Link Inspector page), and the first page of any other site. While it runs you'll see progress; when it's finished, the report. GET /api/tools/link-check/list lists your reports from the last 30 days. One check runs at a time.

DMARC reports

curl https://kt8.com/api/tools/dmarc \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

curl "https://kt8.com/api/tools/dmarc/domains/example.co.uk?days=30" \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

The first call lists your domains, each with its own report address to put in your DMARC record, and your recent uploads. The second reads one domain: who sent email as it, how much passed, and what to fix. days can be 7, 30, 90 or 395 (reports are kept for 13 months).

To add a domain, POST /api/tools/dmarc/domains with {"domain":"example.co.uk"}. You can watch up to 3. Reports only show once you've proved the domain is yours on the DMARC reports page, and until then the answer has "verified": false and the record to add. GET /api/tools/dmarc/uploads/<id> reads report files you uploaded on the page.

My domains

curl https://kt8.com/api/tools/domains \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••"

curl -X POST https://kt8.com/api/tools/domains/check \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.co.uk"}'

The list shows each domain you watch with its renewal date, certificate, whether the site is up, blocklist results and what changed. We check every 6 hours on our own; check looks again now. During the preview you can watch one domain.

Short links

curl -X POST https://kt8.com/api/links \
  -H "Authorization: Bearer kt8t_Ab12••••••••••••••••••••••••••••" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.co.uk/offer","name":"offer","title":"Autumn offer"}'

{"ok":true,"link":{"code":"offer","short":"https://8t.uk/offer","url":"https://example.co.uk/offer","title":"Autumn offer","status":"on"}}

name and title are optional; leave out name for a random ending. GET /api/links lists your links with their clicks this week, and GET /api/links/<code>?days=30 gives one link's click report (add /csv for a spreadsheet).

QR codes

QR codes are made in your browser on the QR codes page, so there's no API to call and nothing reaches us. Plain codes never expire. To make a code you can change later, make a short link first and turn that into a QR code.

Errors and limits

Anything that goes wrong comes back with an HTTP error status and a plain-English error to show or log:

{"error":"You can run 10 speed tests a day during the preview. Please try again tomorrow."}

During the preview each person can run 10 tests a day in each tool, whether on our pages or through the API. Questions or ideas? Ask in the community.

Other KT8 APIs