Skip to main content

Authentication

All API requests require authentication using an API key.

API Key Authentication​

Include your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

Example Request​

curl -X POST "https://api.pdfgenstudio.com/api/v1/renderer/html" \
  -H "Authorization: Bearer pk_live_abc123xyz" \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Hello World</h1>"}'

API Key Types​

TypePrefixDescription
Livepk_live_Production API key with full access
Testpk_test_Sandbox key for development/testing

Managing API Keys​

Creating a New Key​

  1. Log in to your Dashboard
  2. Go to Settings → API Keys
  3. Click Create New API Key
  4. Give your key a descriptive name
  5. Copy the key immediately (it won't be shown again)

Revoking a Key​

  1. Navigate to Settings → API Keys
  2. Find the key you want to revoke
  3. Click the Revoke button
  4. Confirm the action
danger

Revoking a key is immediate and permanent. Any applications using that key will stop working.

Security Best Practices​

Do's ✅​

  • Store API keys in environment variables
  • Use different keys for development and production
  • Rotate keys periodically
  • Set up IP whitelisting if available

Don'ts ❌​

  • Never commit API keys to version control
  • Don't expose keys in client-side JavaScript
  • Don't share keys between applications
  • Don't include keys in URLs

Environment Variables​

Store your API key securely using environment variables:

Node.js​

// .env file
PDFGEN_API_KEY=pk_live_abc123xyz

// In your code
const apiKey = process.env.PDFGEN_API_KEY;

Python​

import os

api_key = os.environ.get('PDFGEN_API_KEY')

Bash​

export PDFGEN_API_KEY="pk_live_abc123xyz"

Error Responses​

Invalid API Key​

{
  "error": "Unauthorized",
  "message": "Invalid or missing API key",
  "statusCode": 401
}

Expired or Revoked Key​

{
  "error": "Unauthorized",
  "message": "API key has been revoked",
  "statusCode": 401
}
Last updated on