Skip to main content

​
API keys

Every request to PDFBase requires an API key passed in the Authorization header.

​
Key types

Test keys generate fully functional PDFs with a diagonal “PDFBASE TEST” watermark. Use them for development and CI pipelines.

​
Key management

Create, rotate, and revoke keys from the API Keys page in your dashboard.
  • Each account can have up to 5 live keys and 5 test keys active simultaneously.
  • Keys can be scoped to specific operations (e.g., create-only, read-only).
  • Rotating a key gives you a 24-hour grace period where both old and new keys work.

​
Key scopes

Restrict what a key can do by assigning scopes at creation time.

​
Security

Never expose API keys in client-side code, public repositories, or browser requests. PDFBase is a server-side API.

​
Best practices

  1. Use environment variables. Store keys in PDFBASE_API_KEY, never hardcode them.
  2. Use test keys in CI. Your test suite should never touch live keys.
  3. Scope keys narrowly. A service that only generates PDFs doesn’t need templates:write.
  4. Rotate quarterly. Use the 24-hour grace period to update all services without downtime.
  5. Monitor usage. The dashboard shows per-key usage — a spike on a key you don’t recognize means it’s leaked.

​
IP allowlisting

For additional security, restrict API keys to specific IP addresses or CIDR ranges from the dashboard. Requests from non-allowed IPs return 403.