API Credentials

Use the API Credentials section to manage conversion API keys, Personal Access Tokens, and the webhook signing secret for async callbacks.

Credential	Use it for	Header
Conversion API Key	Generating PDFs through /v1/direct, /v1/sync, /v1/async, and checking /v1/usage.	API-KEY
Personal Access Token	External tools that manage templates for the issuing user's current team through the Template API.	PERSONAL-ACCESS-TOKEN
Webhook Signing Secret	Verifying that /v1/async callback requests came from PDFBolt.	x-pdfbolt-signature verification

Conversion API Keys

• Manage Multiple Keys: Generate and manage up to 5 API keys.
• Assign Descriptive Names: Name your API keys by purpose, such as staging or production.
• Manage Key Status:
  • Active: Keys currently in use and functional. Newly generated keys are active by default.
  • Blocked: Keys that can no longer authorize API requests.
• Rename Keys: Update key names when their purpose changes.

How to Use

1. Generate New Keys: Click New API Key to create a key if fewer than 5 keys exist, or use the key created automatically at registration.

2. Copy Key: Click the Copy icon next to a key to copy it to your clipboard.

3. Use the Key: Send the key in the API-KEY header when calling the conversion API.

4. Rename Existing Keys: Use Edit to change a key name. Names can be up to 50 characters.

5. Block a Key: In the edit dialog, change the key status to Blocked only when you want the key to stop authorizing API requests.

Security Notes

• Keep your API keys secure: Do not share them publicly or expose them in client-side code.
• Blocked keys cannot be unblocked in the Dashboard: Once an API key is blocked, create a new key or contact support to restore access.

Personal Access Tokens

Personal Access Tokens authenticate external tools as the issuing user and grant access to Template API operations on that user's current team. They are separate from conversion API keys and are intended for CI workflows, Claude Code, Codex, and other AI-assisted template editors.

• Create token: Click New Token in the Personal Access Tokens section.
• Copy token: Click the copy icon next to the token.
• Use token: Send it in the PERSONAL-ACCESS-TOKEN header.
• Deactivate token: Deactivate a token when an external tool should stop accessing your templates. Deactivation cannot be undone in the Dashboard, and the token continues to count toward the limit.
• No automatic expiry: Tokens stay active until you deactivate them.

PERSONAL-ACCESS-TOKEN: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Security Notes

A Personal Access Token grants the issuing user full Template API access to every template visible to their current team. It can list templates; read their active Base64-encoded HTML, sampleData, and parameters; create or replace drafts; publish production versions; and run preview or diff renders that consume the team's conversion credits. Personal Access Tokens have no fine-grained scopes and do not expire automatically.

Store each token in an environment variable or secret manager, issue a separate token for each integration, and never expose it in client-side code, logs, or source control. Deactivate a token when it is no longer needed or may have been compromised.

Webhook Signature

The Webhook Signature section shows the secret PDFBolt uses to sign callback requests from /v1/async conversions. Use it only to verify that an async webhook came from PDFBolt.

• Click the eye icon to show or hide the secret.
• Click the copy icon to copy it to your clipboard.

For details on how to verify webhook signatures in your code, see Webhook Signature Verification.