Authentication

Rendering

Authentication

The Cloud API authenticates with a secret server key, scoped to its organization.

bash
Authorization: Bearer sk_live_…      # or ?token=sk_live_…

POST /v3/render and POST /v3/import are public (they only work on what you send, no stored data). The templates, webhooks and emails endpoints require a server key, which stays on your backend. A publishable pk_live_… token is refused there, because it is visible in your frontend; an invalid or inactive key returns 401.

Which key works where

  • sk_live_… server key: every /v3 route. Keep it on your backend.
  • pk_live_… publishable token: the browser editor only. /v3 refuses it, and also refuses an older token that has no key type.
  • No key: POST /v3/render and POST /v3/import.

A missing, unknown, inactive or publishable key gets 401 with { "error": "invalid_token" }.

Getting and storing the key

A new server key is shown in full only once, when you create it (see embed tokens). Later reads show it masked, so save it to your secret store right away. Use the ?token= form only where you cannot set a header, such as a provider's webhook URL for delivery events.

Rate limits

Every /v3 response carries RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy headers, counted per key (or per IP when there is no key). Over the limit you get 429 with a Retry-After header.