ReflowPDF API api.reflowpdf.com/v1

    Authentication

    Every request carries your API key; it acts as your account.

    POST /v1/pdf HTTP/1.1
Host: api.reflowpdf.com
Authorization: Bearer rpdf_9mX…
Content-Type: application/json

    Keys are made and revoked in the editor (account menu → API keys); an account has up to 10. The same keys connect AI assistants to your account through ReflowPDF's MCP server.

    • A key prints as its account: pages count to the account's plan, its library templates are the key's too.
    • A key is shown once, when it is made — we keep only its hash. Lost, revoke it and make another.
    • A revoked key answers 401 invalid_api_key at once.
    • Keep keys on your server. Calls from a browser would hand your key to anyone who opens the page, so the routes a key opens answer no cross-origin request. Only the public ones do: the OpenAPI description, GET /v1/engines, GET /v1/status, an engine license's token, and the profiles and fonts a licensed engine fetches.

    What a key may do#

    Each key has its scopes — set when it is made, changed any time under Access beside it:

    ScopeLets the key
    printprint — POST /v1/pdf, /v1/images, /v1/layout and a template's; jobs; delete its files; list the print conditions. With it, a licensed engine's profile and font requests are answered too.
    templatesread templates — GET /v1/templates, and a template with its source (yours included).
    accountread the account: GET /v1/usage, the webhook secret (GET /v1/webhook-secret, POST …/rotate).
    assistantconnect an AI assistant through the MCP server.

    A key made under API keys has print, templates and account; one made under Connect AI assistants, or that an assistant signed in for, has assistant alone. A request a key may not make answers 403 insufficient_scope, naming the scope it lacks.

    Where a key is used from#

    A key can be kept to your servers: up to 20 IP addresses and CIDR blocks (203.0.113.0/24, 2001:db8::/32), under Access. A request from any other address answers 403 ip_not_allowed, saying the address it came from — the key is refused there even if it leaked. Without addresses, a key works from anywhere.