Authentication

Every /v1/* endpoint requires a bearer token. Tokens are workspace-scoped API keys minted in Account Settings → API keys.

Header format

Authorization: Bearer pxd_...

One key type

There is one kind of key, on every plan: pxd_. There is no test key, no sandbox key, and no watermark. Credits are the volume limit; your plan sets the per-minute rate limit.

What a free account gets

No sales call, no card. Sign up, open Account Settings → API keys, click New key: you get a pxd_ key immediately and can render straight away.

• 100 credits on signup, and they never expire. A standard render costs 1 credit per 3 pages; output above 1.5x scale costs double. See GET /v1/pricing.
• Renders are clean — no watermark on Free, on any format. Pass watermark: true if you want one.
• 20 requests / minute on Free, 60 on a paid plan. Read the RateLimit-* headers on your own response — see Rate limits.
• Upgrading raises the rate limit and your credit grant. Your integration code and your key do not change.

Key format

• Prefix: pxd_ — no staging prefix; staging uses a separate database. Older pxd_live_ / pxd_test_ keys still work and behave identically.
• Body: base64url-ish random string, ~40 chars.
• The API verifies each request against a SHA-256 hash of the key; the plaintext copy is retained in your account so you can copy it across devices from the Playground and Account Settings.

What the key authorizes

• Any template_id owned by the same workspace that owns the key.
• Credits from the workspace owner's balance.
• Rate-limited per key (see Rate limits).

What it does NOT authorize

• Templates in other workspaces — returns 403 template_forbidden.
• Non-existent template IDs — returns 404 template_not_found.

Rotating a key

Create the new key first, deploy it, then revoke the old one. Revoked keys return 401 api_key_revoked.