Authentication
The REST API authenticates with a workspace API key sent in the X-API-Key
header. Keys look like:
pc_live_xxxxxxxxxxxxxxxxxxxxCreating a key
- Sign in at imaginepdf.com .
- Open Settings → API Keys.
- Create a key (workspace admins only). Optionally set an expiration date.
- Copy the key immediately — it is shown only once. Only a hash is stored, so a lost key cannot be recovered; create a new one instead.
Treat API keys like passwords. They carry the full permissions of the workspace. Store them in a secret manager or environment variable — never in source control or client-side code.
Using a key
Send it on every request:
curl https://api.imaginepdf.com/api/v1/designs \
-H "X-API-Key: $IMAGINEPDF_API_KEY"Verifying a key
Returns the workspace the key belongs to. It is the cheapest way to check a key and the natural “connection test” for an integration — use it instead of listing designs.
curl https://api.imaginepdf.com/api/v1/me \
-H "X-API-Key: $IMAGINEPDF_API_KEY"Response 200 OK
{
"status": "success",
"data": {
"workspaceId": "ws_abc123",
"workspaceName": "Acme Inc",
"userEmail": "you@acme.com",
"keyName": "Zapier"
},
"error": null
}workspaceName is a good label to show users when they connect an ImaginePDF
account, and keyName distinguishes two keys issued from the same workspace.
This route answers “is the key valid and entitled”. A key belonging to a
workspace whose plan lacks useApiKeys returns 403, not 200 — see Scope
below.
Scope
- Workspace-scoped. A key acts within exactly one workspace. Designs, assets, credits, and batch jobs all belong to that workspace.
- Plan-gated. API access itself is a plan feature (
useApiKeys). If the workspace plan does not include it, key creation and all key routes return HTTP 403. See Credits & plans.
Authentication errors
| HTTP | error.code | Meaning |
|---|---|---|
| 401 | UNAUTHORIZED | No key supplied. |
| 401 | INVALID_API_KEY | Key is malformed or does not exist. |
| 401 | API_KEY_EXPIRED | Key passed its expiration date. |
| 403 | INSUFFICIENT_PERMISSIONS | Key is valid but the workspace plan lacks the feature. |
See Errors for the complete table.
Browser sessions use cookies and Bearer tokens; the public API and the Claude Code plugin use API keys. The two paths are independent — an API key is the only credential you need for everything in this reference.