Publishable Keys
Browser-safe API calls. No backend required.
A publishable key (po_pk_) may live in frontend code: scope-limited, origin-locked and budget-capped.
For Claude Artifacts, ChatGPT Canvas, Grok and any web app of your own.
- Own EU infrastructure Your data remains in Europe.
- ISO 27001 active Security certified.
- SOC 2 Type II active International audit standards.
- 24+ years of experience Proven. Stable. Future-proof.
Straight from the browser
From an AI canvas straight to the API call
You build a PDF-to-text app in Claude Artifacts, ChatGPT Canvas or Grok. Without a backend, the API call used to fail: CORS blocked it, a secret key would be visible in the source code, and an open key would burden your account. Publishable keys close exactly this gap.
Paste into Claude, ChatGPT or Grok
One prompt that turns any AI canvas into a real, API-backed demo — no backend required.
Read this API doc:
https://api.paperoffice.ai/latest/docs/llms-full.txt Build a single-file React app (Claude Artifact / ChatGPT Canvas / Grok):
User uploads a PDF, the app calls
/job/add/paperoffice_aiocr___generate directly from the browser
and shows the extracted text. Auth: Bearer po_pk_MY_PUBLISHABLE_KEY (prompt user for the key).
Use processing_lane=instant for sync results. Origin header is set by the browser.Pick a preset, create a key, paste it.
The dashboard ships presets for scopes and budget. Origins stay empty — paste the Origin header from the browser DevTools, then copy the key into your prompt.
const form = new FormData();form.append("file_1", fileInput.files[0]);form.append("processing_lane", "instant");form.append("client_wait", "true");const response = await fetch("https://api.paperoffice.ai/latest/job/add/paperoffice_aiocr___generate", { method: "POST", headers: { Authorization: "Bearer po_pk_YOUR_PUBLISHABLE_KEY" }, body: form,});console.log(await response.json());curl -X POST "https://api.paperoffice.ai/latest/job/add/paperoffice_aiocr___generate" \ -H "Authorization: Bearer po_pk_YOUR_PUBLISHABLE_KEY" \ -H "Origin: https://app.example.com" \ -F "[email protected]" \ -F "processing_lane=instant" \ -F "client_wait=true"First call
fetch from the browser, Origin set by the browser
The call goes to POST /latest/job/add/{pipeline} — the same endpoint as with a secret key. Only the key type and the Origin header, which the browser sends automatically, are new.
- Origin comes from the browser
fetch sets the Origin header itself. Scripts outside the browser (cURL, Node) must send it explicitly — otherwise the API answers 403 ORIGIN_HEADER_REQUIRED.
- Result inline
With processing_lane=instant and client_wait=true the API holds the connection and returns the result directly in the response.
- Clear error codes
402 BUDGET_EXHAUSTED, 403 DOMAIN_NOT_ALLOWED, 403 SCOPE_NOT_GRANTED, 429 RATE_LIMIT_EXCEEDED — every limit reports with its own code.
Security matrix
Six controls, all enforced server-side
Scope-limited, origin-locked, budget-capped, revocable at any time. Every control is enforced server-side — which is why the key may sit in frontend code.
-
Scope-limited
Keys only reach the endpoint groups you explicitly allow:
ocr:read,llm:generate,translate:textand more. Out-of-scope calls return HTTP 403. -
Origin-locked
Every request must carry an Origin header matching the token allow list (exact host or subdomain wildcard). If it does not match, the API returns HTTP 403.
-
No extra per-minute cap
There is no extra per-minute cap unique to po_pk_. Normal per-token account rate limits apply; spend is capped by the lifetime budget.
-
Budget-capped
Every key carries a lifetime budget. Once it is used up, the API returns HTTP 402 BUDGET_EXHAUSTED — spend stops there, not at invoicing time.
-
Revoke at any time
Keys can be revoked in your account at any time. A revoked key is no longer accepted by the API.
-
Hard-blocked
HTTP DELETE plus account login, key management, OAuth, partner admin, payment-method mutation and password-cracking stay hard-blocked for every po_pk_. Documented product APIs — including POST deletes, webhooks, billing reads and CRM — are allowed.
Key hierarchy
Three key types, clear responsibilities
Secret key for the server, publishable key for the browser — plus a user token for user-scoped, rate-limited access.
| Prefix | Type | Use case | Browser-safe | Default scope |
|---|---|---|---|---|
po_sk_ | Secret Key | Server-to-server, full API | No | All endpoints |
po_ut_ | User Token | User-scoped, tier-limited | No | Tier-based |
po_pk_ | Publishable Key | Browser / AI canvas (Claude, ChatGPT, Grok) | Yes | Scope list |
Three presets
One click. One key. One purpose.
Each preset is tuned for a concrete use case — safe defaults, curated scopes, realistic budgets. You can fine-tune everything in the dashboard later.
-
DEFAULTSafe readSafe default rights for simple demos and internal tools: OCR, LLM, Translate, Documents, Search.
Scopes
Start with this preset -
AIDEMOAI playground RecommendedFor Claude Artifacts, ChatGPT Canvas and Grok demos. Everything you need to bring AI demos live.
Scopes
Start with this preset -
WIDGETPublic websiteFor contact forms, chat widgets and booking buttons on your own company site.
Scopes
Start with this preset
First API call
Ready for your first call from the browser?
Create a key, open llms-full.txt, paste the prompt — your app calls the API directly from Claude, ChatGPT or Grok.
Publishable Keys in action
See how PaperOffice Publishable Keys works in practice — in this video.
Frequently asked
Everything you need to know
How is po_pk_ different from po_sk_?
po_sk_ (Secret Key) is for server-to-server integration — full access to the API, never put it in the browser. po_pk_ (Publishable Key) is built for browser code: scope-limited, origin-locked, budget-capped. Same API, different safety profile.
Why not just use a reverse proxy from my own backend?
This is the classic approach — but it still requires a backend. AI artifacts (Claude, ChatGPT, Grok) are designed for zero-backend deployment. Publishable keys make this possible without exposing your secret key: limits are enforced server-side.
Does this work in Claude Artifacts despite the CORS sandbox?
Yes. The call runs straight from the browser, and the browser sets the Origin header itself. PaperOffice does not ship a vendor allow list; paste the Origin from DevTools when you create the key.
What happens if my po_pk_ becomes publicly visible?
The damage stays contained: the origin lock blocks use on other domains, the budget limit ends spend, the rate limit slows automated access. Revoke the key in your account — after that the API no longer accepts it.
Can I add my own domain as an allowed origin?
Yes. When creating the key you add any origin to the allow list — as an exact host or a subdomain wildcard. The WIDGET preset is built for exactly this: register your own domain and embed chat, booking or contact widgets without a backend.
How do I set the budget per key?
When creating the key you pick a lifetime limit; each preset comes with a default. Once the limit is reached, the API returns HTTP 402 BUDGET_EXHAUSTED. You can adjust the value in your account at any time.
Does a po_pk_ need its own plan?
No. The publishable key is an extra layer around your existing account: it limits scopes, origins and budget. The pricing overview shows which plan fits your setup.
Which endpoints are off-limits for po_pk_?
HTTP DELETE plus account login, user-admin, key management, OAuth, partner admin, Stripe checkout and password-cracking are hard-blocked. Documented product APIs are allowed, including POST deletes, webhooks, billing reads, import and CRM. Workspace delete, empty trash and legal-hold release stay UI-only (403 UI_ONLY_ENDPOINT).
Operations and trust
What enterprise teams check before the first call
Contracts, security, support and limits, all linked in one place.
- Security and compliance ISO 27001, SOC 2 Type II, own EU infrastructure.
- SLA 99.9% Availability per calendar month, contractually assured.
- Data processing agreement (DPA) GDPR-compliant data processing agreement.
- Sub-processor list Every sub-processor, listed transparently.
- Technical support Direct line to the support team, with a ticket.
- Rate limits and headers Documented minimums per token, RateLimit headers in every response.
- Pricing and credits Transparent credit prices per call.
Next station
Where to go next
The recommended next step in the developer funnel and two fitting branches.
