Bytefusedocs
Subscribe

Getting started

Authentication

Most tools accept an API key, a dashboard JWT, or — for light tools — no credentials at all. Requests are resolved in a fixed priority order, so you only ever send one.

Ways to authenticate

The API resolves credentials in this priority order and uses the first one it finds:

  1. JWT bearer — Authorization: Bearer <token>. Used by the dashboard and self-serve web app.
  2. API key — X-API-Key: dt_live_…. The standard path for server-to-server integrations.
  3. Anonymous free-try — no credentials. Allowed on a fixed allow-list of light tools.

Send exactly one. If several are present, the bearer token wins.

API keys

Create keys in your dashboard. Self-serve keys are always prefixed with dt_live_. Send the key in the X-API-Key header (the lowercase x-api-key alias also works):

Request header
X-API-Key: dt_live_xxxxxxxxxxxxxxxxxxxxxxxx

Treat keys like passwords

A key spends your credits. Keep it on your server, never in browser code or a public repo. Rotate immediately if one leaks. An unknown or expired key returns 401.

JWT bearer tokens

If you’re building against the same backend as the web dashboard, authenticate with the access token you receive from the login flow:

Request header
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

JWT calls are treated as dashboard traffic: API-key-only features such as scopes and per-key budgets don’t apply to them.

Anonymous free-try

Light tools can be called with no credentials so you can evaluate them instantly. Just omit every auth header. Anonymous calls:

  • are charged 0 credits (the X-Credits-Charged header comes back 0);
  • are limited to an allow-list of light operations — e.g. compress, merge, split, convert, text watermark;
  • are rate-limited by IP: 40 requests/hour and 150 requests/day.

Login-only tools

AI tools, OCR, PDF→Markdown, PII redaction, text replacement, certificates and HTML→PDF always require authentication. Calling one anonymously returns 401. See Credits & billing for why.

Scopes & per-key budgets

API keys can be locked down at creation time — useful for handing a key to a single integration:

  • Scopes — restrict a key to specific operations. A key with no scopes (or *) is unrestricted; calling an out-of-scope operation returns 403.
  • Per-key monthly budget — cap the credits a single key can spend per month. Exceeding it returns 402, and the check runs before any work, so a blocked call costs nothing.

Account status

Even with valid credentials, an inactive account is refused with 403:

  • Suspended → 403 “Account has been suspended”.
  • Pending (email unverified) → 403 “Please verify your email address”.
  • Any non-active state → 403 “Account is not active”.
PreviousQuickstartNext Credits & billing