Authentication

API keys are the recommended way to authenticate programmatic requests. API key limits depend on your plan:

• Free Plan: No API keys. API access is a paid feature — requests made with a key from a downgraded account are refused too, not just new key creation.
• Pro Plan: Up to 5 active API keys for multi-environment deployments.
• Business Plan: Up to 20 active API keys.
• Guest Users: API key creation and API access require a registered account.

All conversions started through the API share the canonical plan quota (e.g. Free: 100 MB max file, 1 GB / day processing data; Pro: 2 GB max file, 3 GB / day) and queue concurrency controls.

Using an API Key

Pass your API key in the x-api-key header:

curl -X POST https://api.orbconvert.com/api/conversions \
  -H "x-api-key: ch_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"fileId": "file_abc123", "toFormat": "docx"}'

Or pass it as a Bearer token in the Authorization header:

curl -X POST https://api.orbconvert.com/api/conversions \
  -H "Authorization: Bearer ch_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"fileId": "file_abc123", "toFormat": "docx"}'

JWT tokens are used for browser-based authentication. When you log in via the web app, you receive a JWT that expires after 7 days (the default system session lifetime).

Login

curl -X POST https://api.orbconvert.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your_password"}'

The response includes a token field. Use this in subsequent requests:

curl -X GET https://api.orbconvert.com/api/users/me \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

OrbConvert supports sign-in via Google and GitHub. When using OAuth:

• The first sign-in creates an account linked to your OAuth provider
• You can add a password later in your Profile settings
• API keys work the same regardless of the auth method used

Unauthenticated users can convert files with limited quota. The API identifies guests by IP address and an optional x-guest-fingerprint header.