Authentication

Bearer token authentication

All API requests must include a valid token in the Authorization header:

Authorization: Bearer YOUR_API_TOKEN

A token belongs to a team, not to the person who created it, and acts in that team only: its templates and its webhooks, with the plan and quota of the team's owner. Only the team's owner and admins create and delete tokens, in Settings → API Tokens, which shows who created each one and when it was last used. A token keeps working when its creator leaves the team. Tokens have no scopes or permissions to configure. When you create one, you can make it expire after 30, 90 or 365 days.

Authentication errors

A request without a token, or with a token that is invalid or revoked, receives a 401:

{
  "message": "Unauthenticated."
}

A valid token whose account has not confirmed its email address yet receives a 403. Open the link in the confirmation email, then retry:

{
  "message": "Verify your email address to continue.",
  "email_unverified": true
}

Creating a token

1. Go to Settings → API Tokens in your dashboard
2. Click Create Token
3. Enter a name (e.g. "Production", "Staging", "CI/CD")
4. Click Create
5. Copy the token immediately

Example request

curl https://pdfstork.com/api/v1/templates \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Accept: application/json"

Revoking tokens

To revoke a token, go to Settings → API Tokens and delete the token. The token becomes immediately invalid and all requests using it will be rejected.

Security best practices

• Store tokens as environment variables, never in source code
• Use different tokens for different environments (production, staging, development)
• Rotate tokens periodically by creating a new one and deleting the old one
• Revoke tokens immediately if they are compromised