Authentication

One header on every request that needs a key: Authorization: Bearer followed by your key.

Text

Authorization: Bearer YOUR_API_KEY

That is the only place we read it. Nothing needs to be signed or refreshed.

Get a key

Sign in with Google or GitHub at app.pdfconversionapi.com, and you get a free API key on the Free plan: 250 conversions a month, files up to 10 MB and 1 conversion at a time.

The key is shown once, right after it is made, with a Copy button. Copy it then and put it where your code reads it (below). We can't show it to you again.
We keep only two things from the sign-in: your verified email address and your account id at Google or GitHub.
One account per verified email. A Google sign-in and a GitHub sign-in with the same verified email address lead to the same account.

Billing isn't open yet, so the Free plan is the only one you can get yourself. For higher limits before billing opens, write to sales@pdfconversionapi.com. Pricing lists the plans.

Keep the key secret

Anyone who has your key can convert files on your account. So:

Keep it in an environment variable, not in your source code. Every example on this site reads it from PDFCONVERSIONAPI_KEY:
Shell
```
export PDFCONVERSIONAPI_KEY="paste-your-key-here"
```
Never put it in client-side code, such as a web page's JavaScript or an app you ship to users. Anyone who has the page or the app can read it. The API sends no CORS headers, so a browser won't let a web page on another site call it anyway. Call the API from your backend and send the converted file to the browser yourself.
Never put it in a URL. A key in the query string, such as ?Secret=... or ?Token=..., is not read, and the request gets a 401. URLs end up in access logs and proxy logs far more often than headers do, so we don't accept keys there.
If it leaks, for example in a commit, replace it.

On the key page at app.pdfconversionapi.com, Replace the key makes a new key and shows it once. The old key stops working within about a minute (the gateway caches key lookups for up to a minute); from then on, requests with it get a 401. Update the key everywhere you use it right after you replace it.

Replace the key if it may have leaked, or if you lost it. We can't show you a key again (How we store keys).

Delete your account

You can delete your account on the same page. That deletes the account and its sign-ins, and the key stops working within about a minute.

Which requests need a key

Request	Key
`POST /v2/convert/{from}/to/{to}`	Required
`GET /v2/usage` (your plan and this month's usage)	Required
`DELETE /v2/d/{id}` (delete a stored file early)	Required, and it must belong to the account that created the file
`GET /v2/d/{id}/{name}` (download a stored file)	Not needed. The link works for anyone who has it until it expires, so treat it like a password.
`GET /v2/info` (list of conversions)	Not needed
`GET /health`	Not needed

Check that a key works

GET /v2/usage is the smallest request that needs a key, and it doesn't use a conversion:

Shell

curl -sS -o /dev/null -w '%{http_code}\n' \
  https://api.pdfconversionapi.com/v2/usage \
  -H "Authorization: Bearer $PDFCONVERSIONAPI_KEY"

200 means the key works. 401 means the key is missing, unknown or no longer valid.

Check your usage

GET /v2/usage returns your plan, its limits and this month's count as JSON:

Shell

curl -sS https://api.pdfconversionapi.com/v2/usage \
  -H "Authorization: Bearer $PDFCONVERSIONAPI_KEY"

For a key on the Free plan that has made 12 conversions in November 2026, the answer looks like this (formatted for reading):

Output

{
  "Plan": "Free",
  "Included": 250,
  "Used": 12,
  "Remaining": 238,
  "Overage": false,
  "Running": 0,
  "ConcurrentLimit": 1,
  "MaxUploadMB": 10,
  "PeriodStart": "2026-11-01T00:00:00.000Z",
  "PeriodEnd": "2026-12-01T00:00:00.000Z"
}

Field	What it is
`Plan`	The name of your plan, for example `Free`.
`Included`	Successful conversions included each calendar month.
`Used`	Successful conversions so far this month. Failed requests aren't counted.
`Remaining`	What is left of `Included` this month. `null` on plans with overage.
`Overage`	`false` if conversions stop when `Included` is used up, as on the Free plan. `true` if the plan keeps converting past it.
`Running`	Conversions running for your account right now.
`ConcurrentLimit`	How many conversions your plan runs at the same time.
`MaxUploadMB`	The largest request your plan accepts, all files together, in MB.
`PeriodStart`, `PeriodEnd`	The start and end of this month's count, in UTC. The count starts again at `PeriodEnd`.

Each call counts toward your account's rate limit of 600 requests a minute (Limits). Limits explains how the month is counted and what happens when a plan limit is reached.

What a 401 looks like

Output

HTTP/1.1 401 Unauthorized
content-type: application/json
www-authenticate: Bearer

{"Code":401,"Message":"a valid API key is required (Authorization: Bearer <key>)"}

The response is the same for a missing key, a wrong key, and a key that was replaced or whose account was deleted. Before looking a key up, we also turn away anything shorter than 16 or longer than 256 characters.

A 403 for a plan that isn't set up

A key whose plan isn't set up on our side gets 403 this key's plan is not set up; write to support. If you see it, write to support@pdfconversionapi.com.

How we store keys

We store only the SHA-256 hash of your key and its last four characters, next to the account it belongs to. Two things follow from that:

We can't show you the key again. If you lose it, replace it.
A copy of our key store contains hashes, not keys.