Skip to content
PDFDispatch

Keys and authentication

Every request needs a key. You make keys in the web app, under Keys: give each one a name (for example the app or server that uses it), so you can see when it was last used and revoke it on its own. You can have several keys per account.

A key starts with pdd_. It is shown once, when you make it; we store only a hash of it, so we cannot show it again. If you lose a key, revoke it and make a new one.

Bearer token

Send the key in the Authorization header:

curl https://api.pdfdispatch.com/v1/convert/html \
  --header "Authorization: Bearer $PDD_KEY" \
  --form files=@index.html \
  --output out.pdf

HTTP Basic auth

For tools that only know Basic auth: any user name (or none), and the key as the password.

curl https://api.pdfdispatch.com/v1/convert/html \
  --user ":$PDD_KEY" \
  --form files=@index.html \
  --output out.pdf

The key is checked at our gateway and taken off the request there; the PDF service itself never sees it.

Keeping keys safe

  • Use keys only on your servers. Never put a key in a web page, a mobile app or a public repository: anyone with a key can make PDFs on your account, and those PDFs count on your plan.
  • Use one key per app or server, so you can revoke one without stopping the others.
  • A revoked key stops working within seconds. Revoking cannot be undone.
  • A PDFDispatch key works only on https://api.pdfdispatch.com.

When the key is not accepted

A missing, wrong or revoked key gets 401 with code 40101; a blocked or closed account gets 401 with code 40102. All codes are in Limits and errors.