Authentication
Make an API key, send it as a Bearer token, choose its scopes and revoke it.
API keys
Owners and admins of a Team, Business or Enterprise account make keys in Settings, then Developers. A key looks like pl_live_ followed by 43 characters. It is shown once, when it is made. PDF Loft stores only a hash of it, so a lost key cannot be recovered: revoke it and make another.
A key acts as the person who made it. It sees the documents and runs that person can see, and it works only while that person is an owner or admin of the account, the account is on a plan that includes the API, and the key has not been revoked or has not expired. Any of these ending stops the key on its next call.
Sending the key
Send the key as a Bearer token in the Authorization header of every call. A key sent in a URL or a query string is not read.
curl https://api.pdfloft.com/v1/jobs \
-H "Authorization: Bearer $PDFLOFT_API_KEY"Keep the key on a server. Do not put it in a browser page, a mobile app or a repository. Calls with a revoked key fail on the next call with api_key_revoked.
Scopes
Each key holds one or more scopes and can do only what they name. A call outside the scopes of the key is refused with insufficient_scope, and the details name the scope it needed.
| Scope | Allows | Status |
|---|---|---|
tools:run | Upload files, run PDF tools and cancel runs. | Available |
jobs:read | Read runs and download their results. | Available |
documents:read | List documents and download them. | Available |
documents:write | Save documents to the library and delete them. | Available |
webhooks:manage | Create, list and delete webhook endpoints. | Available |
signatures:send | Create, send, remind and void signature requests, and send from a template in bulk. | Available |
signatures:read | Read templates and signature requests, and download signed documents and certificates. | Available |
Limits of a key
Every key has its own rate limit, from 1 to 1,000 calls a minute (60 by default), and may have an expiry date up to ten years ahead. An account holds at most 25 active keys. See rate limits.