Authentication |
One API Key. One Header. Done. Bearer Token Authentication without OAuth complexity. Granular permissions, audit logs, automatic rotation – Enterprise Security, made simple.
Two Ways to Test
Visitor: Test via API instantly, no account. Free Plan: Full access with free registration.
- No account needed
- No API key needed
- Basic tools only
curl https://api.paperoffice.ai/v1/status No header needed! - All AI features
- 4 weeks full access
- No credit card
Authorization: Bearer pk_free_... After registration Everything included. No extras.
Other providers: Separate API account, extra base fee, different dashboards. PaperOffice: One account for everything.
App (PWA)
Web app with all features
API Access
REST API from Starter
Webhooks
Real-time events from Professional
All AI Features
Document AI, Agent AI, Automation
One Header. That's it.
No OAuth flows, no token refresh logic, no complexity.
curl -X POST https://api.paperoffice.ai/v1/extract \
-H "Authorization: Bearer po_ut_xxxxx" \
-H "Content-Type: application/json" \
-d '{"file_url": "https://..."}' From Starter. No extra cost.
API access is included in every paid plan. No separate API fee.
Two token types. Clear separation.
System Key
po_sk_... - App internal communication
- Automatically created
- No user assignment
- For system integrations
User Token
po_ut_... - User specific
- Granular permissions
- IP whitelist supported
- Expiration date configurable
Scales with your plan
Higher plan = Higher limits. No hidden throttling.
See specific limits per plan on the pricing page.
Rate limits per planSecurity at the highest level
Key Rotation
Automatic or manual rotation without downtime. Old keys remain active for 24h.
Audit Logs
Every API call is logged. Who, when, what – complete traceability.
IP Allowlist
Restrict API keys to specific IP addresses or CIDR ranges.
Rate Limits
Per-key rate limits prevent abuse and protect your quotas.
Expiration
Create keys with expiration dates – for temporary integrations or audits.
Alerts
Notifications for unusual activity or quota warnings.
API Key in 30 seconds
Register, generate key, send first request. That simple.