From file to reviewed fields.

1. Get a key and self-host the SDK

Open the developer console, activate Free Developer, then create a server key. Save it once as MCS_SERVER_KEY in your backend’s secret manager.

The download is a versioned npm-compatible archive, not a package published to the npm registry. Install the downloaded file:

npm install ./mycreditsignal-credit-parser-0.1.0-preview.1.tgz

Copy node_modules/@mycreditsignal/credit-parser/dist/runtime to your site’s public /credit-parser-runtime directory. Keep the runtime and SDK versions paired, including all licenses and notices. A plain HTML app can instead self-host the entire dist directory and import its index.js; preserve the adjacent chunks.

Serve JS/MJS as JavaScript and WASM as application/wasm. Serve compressed language-model bytes as a file; do not add an incorrect gzip content-encoding header. Static runtime paths must not redirect to login.

2. Connect the browser reader

Call the SDK inside a client component or browser event handler, never during server rendering. Add a currency selector, progress message, cancellation control and editable review view.

import { createCreditParser } from '@mycreditsignal/credit-parser';

const parser = createCreditParser({
  runtimePath: '/credit-parser-runtime',
  authorize: async ({ requestId, signal }) => {
    const response = await fetch('/api/credit-parser-access', {
      method: 'POST', credentials: 'same-origin',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ requestId }), signal,
    });
    if (!response.ok) throw new Error('Access unavailable');
    const data = await response.json();
    if (data.allowed !== true) throw new Error('Access unavailable');
    return { allowed: true };
  },
});

// In your file-input handler; choose USD or CAD explicitly.
const controller = new AbortController();
const result = await parser.parse(selectedFile, {
  currency: selectedCurrency,
  signal: controller.signal,
  onProgress: showStatus,
});
// Wire a Cancel button to controller.abort().
// Render result.facts and warnings locally for human review.
// Do not log or automatically upload the result.

The SDK validates file signature and size before authorization. It returns integer cents, fixed account and institution categories, month-level dates, source-page references and warning codes. Missing values are null; reviewRequired is always true.

3. Authorize from your server

Your endpoint authenticates your end user, checks origin/CSRF and rate limits, then relays only the random request ID. Do not expose an unauthenticated proxy that lets anyone spend your allowance.

// Framework-neutral server sketch. Wire these application-specific
// guards before use. The default must deny, never allow anonymously.
async function authorizeParser(request) {
  if (!sameOrigin(request)) return forbidden();
  const user = await requireSignedInUser(request);
  await enforceUserRateLimit(user);
  const { requestId } = await readStrictUuidOnlyJson(request, 1024);

  const upstream = await fetch(
    'https://app.mycreditsignal.com/api/developer/v1/authorizations', {
      method: 'POST', cache: 'no-store',
      headers: {
        'Content-Type': 'application/json',
        Authorization: 'Bearer ' + process.env.MCS_SERVER_KEY,
      },
      body: JSON.stringify({ requestId }),
      signal: AbortSignal.timeout(10000),
    }
  );
  // Preserve 401/409/429/503 as failures; never return allowed on error.
  if (!upstream.ok) return accessFailure(upstream.status);
  const data = await upstream.json();
  if (data.allowed !== true) return accessFailure(503);
  return noStoreJson({ allowed: true });
}

This outline intentionally leaves your own authentication and rate-limit functions explicit. Keep the key out of NEXT_PUBLIC_ variables, URLs, client bundles, logs and analytics.

API contract & operating limits

POST /api/developer/v1/authorizations accepts JSON with exactly one requestId UUID v4. Maximum 1 KiB, no query parameters, no Origin header. Use your server key in the Authorization header; direct browser calls and CORS are not supported.

• 201: authorized new start. 200: same-allowance-period replay.
• 400: invalid input. 401: invalid/revoked key or disabled account. 403: browser or query request.
• 409: expired request ID. 429: period quota or 30-new-starts-per-minute limit. 503: disabled or temporarily unavailable.

Retry a network or temporary server failure only with the same request ID and a bounded backoff. Never reuse an old ID for a new parse or mint a new ID merely to retry authorization. ID records are retained for 90 days; do not depend on replay after that period.

Free Developer includes 100 authorized starts per UTC calendar month, without a card or automatic billing. Failures and cancellations after authorization count; a same-period retry does not count twice. Up to 3 active keys and 10 new keys per 24 hours. No rollover or automatic overage charges on any self-serve plan.

Use the response’s resetAt timestamp for the next reset. Free period values use YYYY-MM; paid values use the billing-period start as an ISO UTC timestamp. Both paid tiers return plan: "production"; use limit and remaining, not a hard-coded plan allowance.

Input coverage

English-language PDF, PNG and JPEG up to 20 MB; at most 30 PDF pages and 100 extracted accounts. One bureau at a time, with conservative Equifax, Experian and TransUnion labels. Tri-merge is rejected. Encrypted files need an unlocked copy. Scores, complete histories, every report layout and French OCR are not supported.

Extraction is partial. Review all returned amounts and unknown fields. Do not use output alone for credit decisions. Browser support requires Canvas, workers, WebAssembly, createImageBitmap and AbortSignal timeout/any; current Chromium is tested. Test your target Safari, Firefox and mobile devices before claiming support. OCR may take time, especially on a cold first load.

Optional production access

Production is CA$19.99/month for 1,000 authorized starts; Scale is CA$49.99/month for 5,000. Check availability and manage your plan in the developer console. You keep the same SDK and keys. Paid access includes production-use permission under the separate paid SDK terms.

Paid allowances follow your monthly subscription dates, not calendar months. Starts count after authorization even if local reading later fails. Payment must be verified before paid access activates. Cancel renewal in Manage billing; revoking a key or disabling API access does not cancel a subscription. Switching paid tiers is available after the current term ends. Free consumer tools remain independent of SDK billing.

Data handling

The SDK reads the document in browser memory. It does not upload the file or extracted facts, use a hosted LLM, emit telemetry, or store reports in localStorage/IndexedDB. Workers and canvases are released after reading; JavaScript garbage collection is not a guarantee of forensic memory erasure.

The access service stores your developer account, plan, quota, key hashes, revocation times, usage counts and random request IDs. Optional billing adds Stripe customer/subscription references, subscription state, accepted terms and payment-issue references. It does not need report files, names, DOB, SIN/SSN, account numbers, filenames, document hashes, financial results or end-customer IDs. Your sign-in account is separate from document data.

Daily maintenance removes request records and revoked keys older than 90 days, and inactive, unreferenced usage periods and resolved payment-issue records older than 13 months. Active account/key metadata and unresolved billing issues remain while needed. Disabling access revokes keys but preserves usage; contact us for account deletion and billing review. Provider logs and backups have their own retention and may contain ordinary connection metadata.

Your application can still introduce data exposure. Self-host assets, use a restrictive Content Security Policy on both page and worker responses, remove analytics/session replay and untrusted scripts from document views, and disclose any later saving or transmission. Returned financial facts are sensitive even without direct identifiers. The schema’s consentVersion is not proof of user consent.

Local processing is not a GLBA/GDPR exemption or compliance certification. Evaluate your actual implementation, obligations and user notices before production use.

Free developer preview terms

The preview is for development, evaluation and integration testing. My Credit Signal grants a non-exclusive permission to use, copy and adapt its SDK for that purpose and serve the necessary browser assets to your test users. Preserve copyright and third-party notices. This does not grant resale or sublicensing of My Credit Signal’s parser as a competing standalone service. Third-party components keep their own licenses.

The SDK is provided as-is, without an accuracy warranty, uptime commitment or fitness guarantee. Review extracted information and do not rely on it for automated underwriting or credit decisions. Do not submit report content to the access API or attempt to bypass access limits. Browser-local code can be modified; metering counts server authorizations, not all offline execution.

Free Developer never automatically becomes a paid subscription. Optional paid production use requires separate acceptance of the paid SDK terms and a confirmed Stripe payment. Contact us for Enterprise requirements.