Authentication

Every API request must include a valid API key in the Authorization header.

How to authenticate

Authorization: Bearer exdoc_live_your_key_here

Example:

curl "https://exdocapi.cheapehai.shop/api/v1/extract" \
  -H "Authorization: Bearer $EXDOC_API_KEY" \
  -F "file=@document.pdf" \
  -F 'extract={"fields":{"name":"full name"}}'

No sessions, no cookies, no OAuth. Every request is stateless.

API key format

Keys always start with exdoc_live_ followed by a random string. Example:

exdoc_live_Xk9mP2qRvTnLwYjBsAeHdCuFoGiZpN3x

The system stores only a secure hash of your key — the plaintext is never saved. If you lose it, revoke and create a new one.

Managing keys

Go to Dashboard → API Keys.

| Action | How | |--------|-----| | Create | Click New key, give it a name | | View | Only the prefix is shown after creation | | Revoke | Click Revoke — takes effect immediately |

Keys are shown only once at creation. Copy it before closing the dialog.

Best practices

Never commit keys to source control. Use environment variables.

# .env  (add to .gitignore)
EXDOC_API_KEY=exdoc_live_your_key_here

One key per environment. Separate keys for production, staging, and local dev. Revoke independently if one is compromised.

Rotate periodically. Create a new key → update your env → revoke the old one.

Error responses

| Status | Meaning | |--------|---------| | 401 | Missing, malformed, or invalid key | | 401 | Key has been revoked |

{ "error": "Invalid API key" }