CraftMyPDF Authentication: API Key Setup & Security (2026)

Authentication overview

CraftMyPDF utilizes an API key-based authentication system to secure access to its PDF generation and document management services (CraftMyPDF documentation portal). This mechanism ensures that only authorized applications and users can interact with your CraftMyPDF account, create documents, manage templates, and access other features. The API key functions as a unique identifier and secret token, verifying the identity of the client making the API request.

When an API key is included in a request, the CraftMyPDF server validates it against its records. If the key is recognized and active, the request is processed; otherwise, it is rejected, typically with a 401 Unauthorized HTTP status code. This approach simplifies integration for developers while maintaining a necessary layer of security for API interactions.

All communication with the CraftMyPDF API must occur over HTTPS, which encrypts the data in transit, protecting the API key and request payloads from eavesdropping. This is a standard practice for web APIs to ensure data integrity and confidentiality (Mozilla's explanation of HTTPS).

Supported authentication methods

CraftMyPDF primarily supports API Key authentication for its RESTful API. This method is suitable for server-to-server communication and backend applications that generate PDFs on behalf of users.

API keys are typically long, randomly generated strings that are unique to each user or application. They are designed to be kept confidential and should not be exposed in client-side code or public repositories. The CraftMyPDF API expects the API key to be sent in the x-api-key HTTP header for every authenticated request (CraftMyPDF API Reference).

Getting your credentials

To authenticate with the CraftMyPDF API, you need to obtain an API key from your CraftMyPDF account dashboard. The process typically involves these steps:

1. Sign in to your CraftMyPDF account: Navigate to the CraftMyPDF homepage (CraftMyPDF homepage) and log in with your credentials. If you do not have an account, you will need to register for one. A free Developer Plan is available, which includes 50 PDFs per month (CraftMyPDF pricing page).
2. Access the Dashboard: After logging in, you will be redirected to your user dashboard.
3. Locate API Settings: Look for a section related to 'API Keys', 'Developer Settings', or similar. This is usually found in the account or settings menu.
4. Generate a New API Key: Within the API settings, there should be an option to generate a new API key. Some platforms allow you to name your keys for easier management, especially if you plan to use multiple keys for different applications or environments (e.g., development, staging, production).
5. Copy the API Key: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it securely, as it may only be shown once for security reasons. If lost, you typically cannot retrieve it and will need to generate a new one, invalidating the previous key.

It is recommended to generate separate API keys for different applications or environments. This allows for easier key rotation and revocation if a key is compromised, without affecting other services. For detailed instructions, refer to the official CraftMyPDF documentation on API authentication (CraftMyPDF API authentication guide).

Authenticated request example

Once you have your API key, you can include it in your API requests. The CraftMyPDF API expects the API key in the x-api-key HTTP header. Below are examples using curl, Node.js, and Python, which are among the supported SDKs (CraftMyPDF SDK documentation).

Curl Example

curl -X POST \n  https://api.craftmypdf.com/v1/generate \n  -H 'Content-Type: application/json' \n  -H 'x-api-key: YOUR_CRAFTMYPDF_API_KEY' \n  -d '{ \n    "templateId": "tpl_xxxxxxxxxxxxxxxx", \n    "data": { \n      "name": "John Doe", \n      "amount": "100.00" \n    } \n  }'

Node.js Example

const axios = require('axios');

const API_KEY = 'YOUR_CRAFTMYPDF_API_KEY';
const TEMPLATE_ID = 'tpl_xxxxxxxxxxxxxxxx';

async function generatePdf() {
  try {
    const response = await axios.post(
      'https://api.craftmypdf.com/v1/generate',
      {
        templateId: TEMPLATE_ID,
        data: {
          name: 'Jane Smith',
          amount: '250.75',
        },
      },
      {
        headers: {
          'Content-Type': 'application/json',
          'x-api-key': API_KEY,
        },
      }
    );
    console.log('PDF Generation successful:', response.data);
  } catch (error) {
    console.error('Error generating PDF:', error.response ? error.response.data : error.message);
  }
}

generatePdf();

Python Example

import requests
import json

API_KEY = 'YOUR_CRAFTMYPDF_API_KEY'
TEMPLATE_ID = 'tpl_xxxxxxxxxxxxxxxx'

url = 'https://api.craftmypdf.com/v1/generate'
headers = {
    'Content-Type': 'application/json',
    'x-api-key': API_KEY
}
data = {
    'templateId': TEMPLATE_ID,
    'data': {
        'name': 'Alice Wonderland',
        'amount': '500.00'
    }
}

try:
    response = requests.post(url, headers=headers, data=json.dumps(data))
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    print('PDF Generation successful:', response.json())
except requests.exceptions.HTTPError as err:
    print(f'HTTP error occurred: {err} - {response.text}')
except Exception as err:
    print(f'Other error occurred: {err}')

Remember to replace YOUR_CRAFTMYPDF_API_KEY with your actual API key and tpl_xxxxxxxxxxxxxxxx with your specific template ID.

Security best practices

Implementing strong security practices is critical when working with API keys to prevent unauthorized access and protect your data.

• Keep API Keys Confidential: Never hardcode API keys directly into client-side code, commit them to public version control systems (like GitHub without proper precautions), or expose them in public-facing applications. Treat them as you would a password.
• Use Environment Variables: Store API keys in environment variables on your server or in secure configuration files that are not part of your codebase. This prevents them from being accidentally exposed (Google Cloud's API Key Best Practices).
• Restrict Key Permissions (if available): While CraftMyPDF's API keys typically provide full access to your account's API functions, if a platform provides granular permissions for API keys, restrict them to only the necessary operations.
• Rotate API Keys Regularly: Periodically generate new API keys and revoke old ones. This minimizes the risk associated with a potentially compromised key, even if you are unaware of the compromise.
• Secure Your Servers: Ensure the servers and environments where your API key is stored and used are secure, with appropriate access controls, firewalls, and regular security updates.
• Monitor API Usage: Regularly review your API usage logs in the CraftMyPDF dashboard (if available) for any unusual activity that might indicate a compromised key or unauthorized access.
• Use HTTPS for All Requests: Always ensure that all communication with the CraftMyPDF API uses HTTPS (TLS/SSL). This encrypts the data in transit, protecting your API key and request data from interception.
• Error Handling: Implement robust error handling in your applications to gracefully manage authentication failures (e.g., 401 Unauthorized responses) without exposing sensitive information.