ProofPass for developers

Overview

Nothing here writes. Uploads and recipients stay in the dashboard, so the archive and the proof of delivery are never bypassed.

API v1

Base URL https://www.proofpass.eu/api/v1. You create a key in the dashboard under “Embed → API keys”. It is shown once; we store only a SHA-256 hash. Format: pbt_live_ plus 32 characters. Up to 10 active keys per manufacturer, from the Start plan.

Authorization: Bearer pbt_live_…

Endpoints

curl -H "Authorization: Bearer pbt_live_…" "https://www.proofpass.eu/api/v1/products?q=silikon&limit=20"

{
  "id": 11,
  "name": "Silikon Neutral transparent",
  "slug": "silikon-neutral-transparent",
  "articleNumber": "SN-310",
  "gtin": "9006543210017",
  "ufi": "N1Q0-30DW-K00N-4VKE",
  "category": "Silikone",
  "description": null,
  "url": "https://www.proofpass.eu/hersteller/<firma>/silikon-neutral-transparent",
  "qr": {
    "shortUrl": "https://www.proofpass.eu/q/<code>",
    "png": "https://www.proofpass.eu/api/qr/<code>.png",
    "svg": "https://www.proofpass.eu/api/qr/<code>.svg"
  },
  "documents": [
    { "type": "sdb", "typeLabel": "Sicherheitsdatenblatt", "language": "de", "version": "4.1",
      "revisionDate": "2026-01-12", "url": "https://www.proofpass.eu/pdf/<datei>.pdf", "size": 182334 }
  ],
  "safety": null,
  "updatedAt": "2026-10-31T18:00:00.000Z"
}

• documents holds current versions only; version and revisionDate can be null.
• safety is null when no product safety data is maintained; recall holds an active recall notice.
• Hidden products are not listed and answer 404.
• Page URLs and QR links never change; PDF URLs change with every new version, so always link through the API or the product page.

Errors

Limits and caching

• 120 requests per minute per key, sliding window in memory per server instance: a brake against loops, not a hard quota. Wrong keys are also limited per address (30 per minute).
• ETag, Cache-Control: private, max-age=300 and Vary: Authorization. If-None-Match is answered with 304. Cache for 5 to 15 minutes.
• CORS allows GET from any origin, meant for server-to-server calls and tests. Never put the key into browser code.
• New fields arrive without a version change; ignore unknown fields. Changes or removals go to /api/v2, v1 runs at least 12 more months.

MCP server for AI assistants

Address https://www.proofpass.eu/mcp. Model Context Protocol over Streamable HTTP, stateless, JSON answers, read-only, no account and no sign-in. It returns the products of checked manufacturers and the current version of their documents, the same data as the public manufacturer pages. At most 60 calls per minute per address.

https://www.proofpass.eu/mcp

Claude

1. Go to Customize > Connectors (Team and Enterprise: an owner under Organization settings > Connectors).
2. Click + Add, then Add custom connector.
3. Name it ProofPass and enter https://www.proofpass.eu/mcp, then Continue.
4. Under Authentication choose No sign in, then Add.
5. In a chat: + in the lower left, Connectors, switch ProofPass on.

Claude Help Center: custom connectors

ChatGPT

With developer mode on (Settings → Apps → Advanced → Developer mode; in Business and Enterprise your administrators decide), create an app with the address above as URL and authentication “none”. Plans and menu names are OpenAI’s: check their current guide.

OpenAI: developer mode

Microsoft Copilot Studio

Add the server to an agent as a Model Context Protocol tool: server URL as above, transport Streamable HTTP, no authentication. The current steps are in Microsoft’s guide.

Microsoft Learn: add an existing MCP server

Cursor and VS Code

Clients with a configuration file take the entry below (Cursor: mcp.json under mcpServers). VS Code expects the same entry under servers in .vscode/mcp.json.

{
  "mcpServers": {
    "proofpass": {
      "type": "http",
      "url": "https://www.proofpass.eu/mcp"
    }
  }
}

{
  "servers": {
    "proofpass": {
      "type": "http",
      "url": "https://www.proofpass.eu/mcp"
    }
  }
}

Cursor: MCPVS Code: MCP servers

Tools

Every tool takes language ("de" or "en") for the answer. get_current_document takes product (id, QR code, GTIN, "manufacturer/product" or the product page URL), type (sdb, tdb, dop, doc, ppwr, manual, epd, cert, other; also SDS, TDS, DoP, DoC) and optionally document_language. verify_document takes a SHA-256 or a ProofPass PDF URL. Every answer ends with a source line and this note: providing a document here is not a delivery under Art. 31 REACH; the supplier remains obliged to deliver it to its recipients.

{
  "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "get_current_document",
              "arguments": { "product": "9006543210017", "type": "SDS", "language": "en" } }
}

{
  "product": { "id": 11, "name": "Silikon Neutral transparent", "manufacturer": "…", "url": "https://www.proofpass.eu/hersteller/<firma>/<produkt>" },
  "document": {
    "title": "Safety data sheet Silikon Neutral transparent",
    "type": "sdb", "language": "de", "version": "4.1",
    "revisionDate": "2026-01-12", "publishedAt": "2026-01-13T08:00:00.000Z",
    "productUrl": "https://www.proofpass.eu/hersteller/<firma>/<produkt>",
    "pdfUrl": "https://www.proofpass.eu/pdf/<datei>.pdf",
    "sha256": "…", "superseded": false
  },
  "otherLanguages": [{ "language": "en", "pdfUrl": "https://www.proofpass.eu/pdf/<datei>.pdf" }],
  "source": "Source: ProofPass (…), data as published by the manufacturer, retrieved 2026-11-05.",
  "notice": "Note: providing a document here is not a delivery under Art. 31 REACH. …"
}

Counted per day: tool, assistant (from the user agent), manufacturer and product returned, success. Never questions, search terms or answers. Manufacturers see the counts as “AI requests” in their statistics. Server card: https://www.proofpass.eu/.well-known/mcp/server-card.json.

Embed in a website

Two snippets with the manufacturer’s short name; the dashboard (“Embed”) shows them ready to copy. Both show the data sheet search with the products; a new version appears within minutes.

<iframe src="https://www.proofpass.eu/einbetten/<kurzname>/de" title="Datenblätter" style="width:100%;min-height:720px;border:0" loading="lazy"></iframe>

<script src="https://www.proofpass.eu/einbetten/<kurzname>/widget.js" data-lang="en" data-height="900" async></script>

• iframe: the language is the end of the address (/de, /pl …); give it at least 720 pixels of height.
• Script: data-lang sets the language, otherwise the lang of the page, then the browser, then the manufacturer’s own; data-height sets the height (default 720).
• In the Basis and Start plans the script places the link “Provided via ProofPass” into your page; Pro and Business without.
• No cookies, no third parties in the frame.

Embedding guide for WordPress, Shopify, Wix and more

QR codes and GS1 Digital Link

From the Business plan the printed QR code can carry the GTIN as a GS1 Digital Link; the address works for every product with a GTIN.

WordPress plugin

The free plugin shows your data sheets on any WordPress website: as a shortcode, as a block and, in WooCommerce, as a tab on the product page. It uses the official ProofPass embed and works on every plan, including Basis. With an API key (Start plan or higher) the product tab lists the current documents in your shop's own design.

Download proofpass-wordpress.zip (version 1.0.0)

Requirements: WordPress 6.2 or later, PHP 7.4 or later. WooCommerce is optional. Licence GPL-2.0-or-later.

Installation

1. Download proofpass-wordpress.zip.
2. In WordPress, go to Plugins → Add New → Upload Plugin, choose the ZIP file, install and activate.
3. Under Settings → ProofPass, enter your manufacturer: your address https://www.proofpass.eu/hersteller/your-company or just your-company.
4. Optional: paste your API key (dashboard → Einbinden → API-Schlüssel) and click "Test connection".

Settings

"Test connection" asks ProofPass once for the manufacturer behind the key and fills in the short name if the field is empty. Without a key it checks that your embed is reachable.

Shortcode

[proofpass]
[proofpass product="art:SN-310"]
[proofpass product="9006543210017" lang="en"]
[proofpass product="silikon-neutral-transparent" height="400" mode="script"]

If ProofPass cannot find the product, the frame shows the whole search. On the Basis and Start plans the link "Bereitgestellt über ProofPass" is part of the embed; the plugin does not change it. From Pro it is gone.

Block

In the block editor, add the block "ProofPass data sheets". Set product, language, height and display mode in the sidebar, as with the shortcode. The editor shows a summary; the documents appear on the published page.

WooCommerce

Every product page gets the tab "Safety data sheets & manufacturer information". The plugin looks for the matching product in this order, first hit wins:

1. the field "ProofPass product" of the product (Inventory tab, next to the SKU), if you fill it in,
2. the GTIN: the WooCommerce field "GTIN, UPC, EAN or ISBN" (WooCommerce 9.2+), the fields of common GTIN plugins or your own meta key,
3. the SKU as art:<SKU>.

With an API key the tab shows a table of the current documents (type, language, revision date, version, PDF), the manufacturer and responsible person, the safety information in the website's language and an active recall at the top. Without a key the tab shows the product in the embed. If ProofPass has nothing for a product, the tab is hidden (can be switched off).

Caching

The plugin calls the API from the server only and caches the answer (default 6 hours), so a product page triggers at most one request per product and period. Saving a product clears its entry, "Clear cache" in the settings clears all. If ProofPass cannot be reached, the last answer stays visible and the plugin pauses requests for a few minutes. The embed (shortcode, block) is always current.

FAQ

Do I need a paid plan? No. Shortcode, block and the tab with the embed work on every plan. The document list in your shop's design uses the API, available from the Start plan.

Does the plugin set cookies? No, and neither does the embed. Name ProofPass in your privacy policy as embedded content: your visitors' browsers load the frame, the script and PDFs from www.proofpass.eu.

Can anyone see my API key? No. It stays on your server, is not in the HTML and never reaches the browser.

A new data sheet does not show in the tab. The list is cached for up to 6 hours. Save the product or clear the cache.

Does it work with variations? The plugin uses the GTIN and SKU of the parent product. For a different match, enter the ProofPass product in the field "ProofPass product".

Troubleshooting