Authentication

Every request to the API is authenticated with a API key in the x-api-key header.

x-api-key: YOUR_API_KEY

There is no OAuth, JWT or sessions: it is simple authentication by API key, intended for server-to-server calls from your backend or from an agent, not to be exposed directly in a public web client.

Example

curl -X POST "https://api.markpdf.tech/convert/raw?filename=report.pdf" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "content-type: application/pdf" \
  --data-binary "@report.pdf"

Python

import httpx

headers = {"x-api-key": "YOUR_API_KEY", "content-type": "application/pdf"}
r = httpx.post(
    "https://api.markpdf.tech/convert/raw",
    params={"filename": "report.pdf"},
    headers=headers,
    content=open("report.pdf", "rb").read(),
)

const res = await fetch("https://api.markpdf.tech/convert/raw?filename=report.pdf", {
  method: "POST",
  headers: { "x-api-key": "YOUR_API_KEY", "content-type": "application/pdf" },
  body: fileBuffer,
});

Where does the key go on each endpoint

The x-api-key header is the same on all endpoints (/convert, /convert/raw, /convert/from-url, /pdf/index, GET /jobs/{id}). The key is not accepted as a query param or inside the JSON body: it always goes in the header.

Good practices

Save the API key in an environment variable or secrets manager, never in the code or in the repository.
Do not include it in URLs or logs (query params are usually registered in proxies and CDNs).
Use a different key per environment (development, staging, production) to be able to revoke one without affecting the others.
If a key leaks (for example in a log, a public repository or a frontend client), rotate it immediately.
If your application calls API from the browser, do not expose the key directly: proxy the request from your own backend.

Authentication errors

Situation	Status	What to review
Missing `x-api-key` header	`401`	Add the header to each request.
Invavalid or unknown API key	`401`	Verify that you copied the complete key, without spaces or line breaks.
Vavalid key without permission for the requested resource or host	`403`	Check the source `url` and the scope of your key.

A request without vavalid x-api-key responds 401.

If you integrate the API into an AI agent (for example with function calling), do not give the API key to the model as free text at the prompt: inject it into the code that executes the HTTP call, outside the context of the LLM.

Frequently asked questions

Does the API key expire? It depends on your plan; consult the panel where you generated it. Rotating it manually is the recommended way to invavalidate it early.
Can I have several active keys at the same time? Yes, it is the recommended way to separate different environments or applications.
What happens if I send the x-api-key header twice? Only one value is evaluated; avoid this by configuring the HTTP client correctly.

Get started

Concepts

Authentication

Authentication

Example

Where does the key go on each endpoint

Good practices

Authentication errors

Frequently asked questions

​Authentication

​Example

​Where does the key go on each endpoint

​Good practices

​Authentication errors

​Frequently asked questions

Authentication

Example

Where does the key go on each endpoint

Good practices

Authentication errors

Frequently asked questions