Protect

Protect PDF

Encrypt a PDF with AES-256 — set the password needed to open it, an owner password that governs permissions, and which actions (print, copy, modify…) are allowed.

Free to try — no key required 10 credits / callSynchronous

Overview

Upload a PDF and passwords; receive a public R2 URL for the encrypted copy. On the free-try path.

POSThttps://api.bytefuse.in/api/v1/security/security/password/add

The path segment is doubled

The security router carries /security at both the mount and the route, so the real path is /api/v1/security/security/password/add.

Anonymous needs a browser origin

Free-try here works from a browser (which sends an Origin header). A raw server-side call with no key and no origin returns 401 — for programmatic use, send an API key.

Request

Content type multipart/form-data:

filefilerequired

The PDF to protect. Must end in .pdf (else 400).

owner_passwordstringrequired

The owner password that controls permissions.

user_passwordstringoptional

The password required to open the document. If omitted, the owner_password is used as the open password too — so the file always needs a password to open.

encryption_level is ignored

The output is always AES-256, regardless of any encryption_level value you send.

Permissions

Five permission flags actually take effect (all optional booleans):

allow_printdefault truePermit printing

allow_copydefault falsePermit copying text/images

allow_modifydefault falsePermit modification

allow_annotatedefault falsePermit annotations

allow_fill_formsdefault falsePermit form filling

Three flags are accepted but ignored

allow_print_hq, allow_extract and allow_assemble are accepted for forward-compatibility but are not applied. Only the five flags above take effect.

Response

200 OK, application/json:

200 OK

{
  "job_id": "...",
  "status": "completed",
  "operation_type": "add_password",
  "success": true,
  "file_url": "https://<r2-host>/password_protected/20260704/<uuid>.pdf",
  "processing_time_ms": 120,
  "file_size_bytes": null,
  "created_at": "2026-07-04T12:00:00Z"
}

Download from file_url (public, no expires_at). job_id is a throwaway UUID — it isn’t a queryable job. file_size_bytes is currently always null. The X-Credits-Charged header reports the credits billed (0 anonymous).

Examples

curl -X POST https://api.bytefuse.in/api/v1/security/security/password/add \
  -H "X-API-Key: dt_live_your_key" \
  -F "file=@contract.pdf" \
  -F "user_password=open-me-123" \
  -F "owner_password=owner-secret-456" \
  -F "allow_print=true" \
  -F "allow_copy=false"

Errors

400The file isn’t a .pdf, is empty, or the engine couldn’t process it.

422Missing owner_password.

401Anonymous with no browser origin (server-side no-key call).

402 / 429 / 503Insufficient credits, rate limited, or capacity/config error.

To remove a known password instead, see Unlock PDF.

PreviousRedact PII Next Unlock PDF