Authentication

Every request must include an API key in the Authorization header:

Authorization: Bearer pp24_live_…

Live and test keys

• Live keys (pp24_live_) consume your page balance and are meant for production.
• Test keys (pp24_test_) render normally but are not charged. They are rate-limited and marked with X-Pdfpilot-Test: true.

Key safety

• Keys are stored as SHA-256 hashes. We cannot show a key again after creation.
• Revocation is instant and applies to in-flight retries.
• Use one key per product or environment, never a shared key across teams.
• Keys must be sent from a server. Never embed them in browser JavaScript.

Rotating a key

1. Create the new key in the portal.
2. Deploy it to your environment.
3. Watch the old key's “last used” timestamp stop moving.
4. Revoke the old key.

Session auth (portal only)

The dashboard uses a signed, http-only session cookie. Portal endpoints and the public API are never interchangeable: a browser session cannot call /api/v1/*, and an API key cannot open the portal.