Authentication
PDFend uses API keys sent as bearer tokens. Keys have prefixes so you can tell live and test traffic apart at a glance.
Key format
| Prefix | Purpose |
|---|---|
pk_live_… | Production traffic, metered and billed |
pk_test_… | Development, not billed |
Sending a key
bashexample
curl https://api.pdfend.com/v1/generate \
-H "Authorization: Bearer pk_live_..."Caution
Never commit keys to git. Use environment variables and your platform's secret manager.
Rate limits
Rate limits are applied per API key and plan. When exceeded, the API returns HTTP 429 with a Retry-After header.
| Plan | Sustained | Burst |
|---|---|---|
| Free | 1 req/s | 5 req/s |
| Starter | 5 req/s | 20 req/s |
| Pro | 20 req/s | 60 req/s |
| Scale | 60 req/s | 200 req/s |
| Enterprise | Custom | Custom |
Rotating keys
In the dashboard, create a new key, deploy it, then revoke the old one. Revocation is immediate — in-flight requests continue, new requests fail.