Skip to content

Authentication

All API requests (except health checks) require authentication via an API key.

Passing Your API Key

You can authenticate using any of these methods:

curl -H "Authorization: Bearer inv_live_abc123..." \
  https://invoicepdfs.com/api/v1/auth/me

curl -H "X-API-Key: inv_live_abc123..." \
  https://invoicepdfs.com/api/v1/auth/me

curl -H "Authorization: inv_live_abc123..." \
  https://invoicepdfs.com/api/v1/auth/me

Managing API Keys

Create a Key

curl -X POST https://invoicepdfs.com/api/v1/api-keys \
  -H "Authorization: Bearer inv_live_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"name": "staging"}'

Warning

The full API key is only returned once at creation time. Store it securely.

List Keys

curl https://invoicepdfs.com/api/v1/api-keys \
  -H "Authorization: Bearer inv_live_abc123..."

Returns key metadata (ID, name, last 4 characters) — never the full key.

Revoke a Key

curl -X DELETE https://invoicepdfs.com/api/v1/api-keys/key_01ABC \
  -H "Authorization: Bearer inv_live_abc123..."

Revoked keys are immediately invalid.

Verify Your Identity

curl https://invoicepdfs.com/api/v1/auth/me \
  -H "Authorization: Bearer inv_live_abc123..."

{
  "data": {
    "account": {
      "id": "acc_01ABC",
      "name": "Acme Corp",
      "plan_id": "plan_starter",
      "plan_name": "Starter"
    }
  }
}

Rate Limiting

Requests are rate-limited per API key. When you exceed the limit, you'll receive a 429 Too Many Requests response with a Retry-After header indicating when to retry.

Error Responses

Authentication failures return a standard error envelope:

{
  "error": {
    "status": 401,
    "code": "unauthorized",
    "message": "Invalid credentials",
    "request_id": "38f24dafcf099a38a8eb287afef6b3c0"
  }
}

A request with no key or token at all returns "message": "Missing API key or token" with the same unauthorized code.