> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spoolpdf.nandra.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Bearer API keys for POST /v1/render. MCP uses dashboard OAuth instead.

Authenticated renders use a secret API key. Create it at [spoolpdf.nandra.dev/keys](https://spoolpdf.nandra.dev/keys). The raw `spool_live_…` value is shown once.

```bash theme={null}
curl -sS -o out.pdf \
  -X POST https://spoolpdf-api.nandra.dev/v1/render \
  -H "Authorization: Bearer $SPOOLPDF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html":"<h1>Hello</h1>"}'
```

<Warning>
  Do not put the API key in a browser, ChatGPT custom instruction, or public repo. Revoke a leaked key on `/keys`.
</Warning>

## What requires a key

| Path                          | Auth                                       |
| ----------------------------- | ------------------------------------------ |
| `POST /v1/render`             | Bearer API key                             |
| `POST /v1/trial/render`       | None (IP rate-limited)                     |
| `GET /healthz`, `GET /readyz` | None                                       |
| MCP `render_pdf`              | Dashboard OAuth; no key in the chat client |

Missing or invalid Bearer on `/v1/render` returns `401` `unauthorized`.

## Subscription

A canceled or unpaid plan returns `403` `subscription_inactive`. Fix billing on `/billing`, then retry.

## Concurrency

Each plan has a parallel render cap (Free 1, Starter 2, Growth 4, Scale 8). Over that, `/v1/render` returns `429` `concurrency_limit` with `Retry-After` and `X-Concurrency-Limit`. Sandbox still occupies a slot.

MCP does not use a `spool_live_…` key. See [MCP](/guides/mcp).