Authentication

The recommended way to authenticate server-side conversions. Keys start with fc_ and are sent as a Bearer token:

Authorization: Bearer fc_ab12cd34...

• Creating API keys requires a paid plan (Starter, Pro, or Scale).
• The full key is shown only once at creation; it is stored as a one-way hash.
• Revoking a key immediately invalidates it.
• Keys are scoped to your account and cannot be used to access other accounts' data.
• Requests authenticated with an API key are subject to your plan's rate limits, concurrent job limit, and credit costs — identical to using the web app.

Registering or logging in returns an accessToken and a refreshToken. Send the access token as a Bearer token on every authenticated request:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

• Get a token pair via POST /auth/login with your email and password (or register via POST /auth/register).
• Access tokens expire after 15 minutes.
• When the access token expires (HTTP 401), exchange the refresh token via POST /auth/refresh for a new pair.
• Refresh tokens are single-use, expire after 7 days, and are revoked on logout.

• Public: /converter/formats, guest quota, and auth routes.
• Either JWT or API key: conversion endpoints (guests may omit auth entirely), and file downloads.
• JWT required: conversion history, stats, and API key management.