Authentication

How docsgen API keys work, why the key never goes to the browser and which call does not need one.

Every POST carries the key in the authorization header:

-H "authorization: Bearer $DOCGEN_API_KEY"

Getting a key

Write to us and we will hand over your key. It is shown only once, when it is handed over: we don’t store it anywhere, so if it gets lost we issue another one.

The key never goes to the browser

If the fetch runs in code that executes in the browser, the key travels inside JavaScript that anyone can read, and with it anyone can generate documents in your company’s name.

The call is made from your server, which already knows who the user is and what they are allowed to do. Your web application asks your own backend for the document, and your backend asks us.

One key per application

Each integrating application has its own key, and the response includes a header that lets you know who requested each document without us storing it: the service keeps no archive.

The response also carries x-docgen-estilo, which tells you which style the document was produced with. It is explained in The style of each design.

The catalog needs no key

A GET to the same address returns the catalog of types and designs, and it does not need a key:

curl https://docsgen.piensait.com/api/documents

See Choosing the design.