Credentialing, connected to your systems.

Your first certificate

1. Open Settings → API & automation. Create a key with templates:read and certificates:render.
2. Keep the key in your server or automation platform’s secret store.
3. Send certificate details and a template ID. Save the returned PDF.

curl https://certinator.vercel.app/api/v1/render \
  -H "Authorization: Bearer $CERTINATOR_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
    "templateId": "classic",
    "details": {
      "recipient": "Alex Morgan",
      "course": "Logology",
      "issuer": "Your organization",
      "date": "2026-10-30",
      "expiresOn": "2027-10-30"
    }
  }' --output certificate.pdf

Template IDs include classic (Atelier), modern (Meridian), and all twelve built-in styles. Use GET /api/v1/templates for their IDs and your saved templates.

One API, familiar operations

All paths above start with /api/v1. Each request uses Authorization: Bearer …. Browser session cookies are not accepted as API credentials.

Private rendering and public verification

Rendering never registers a new public record. To add working verification, explicitly issue a record first using a stable UUID and the same details. Then pass its ID as verificationRecordId when rendering. Identical issuance retries are safe; changed details return a conflict. Revocation is permanent. An optional expiresOn date stays valid through the end of that date in UTC.

Connect an MCP client

Use https://certinator.vercel.app/mcp with Streamable HTTP and the same bearer key in an Authorization header. The server exposes only the tools allowed by the key. MCP rendering returns embedded PDF/ZIP binary resources, so your client must support saving those resources. Direct render files are not retained. Background jobs provide private downloads for one hour.

Settings → API & automation includes a copyable endpoint, client configuration and a connection check. Give each bot its own key, create a short-lived challenge in Settings, and ask that bot to call validate_connection. A successful check proves access to the assigned key and account; client names are self-reported.

Background generations

Send POST /api/v1/generations with {"id":"YOUR_JOB_UUID","items":[{"templateId":"classic","details":{…}}]} for 1–100 recipients. HTTP 202 returns immediately with a status URL. Reuse that UUID after network retries to avoid duplicate jobs and charges. Jobs reserve their certificate allowance when queued.

Poll GET /api/v1/generations/ID for progress, then download available batches from GET /api/v1/generations/ID/downloads/BATCH (zero-based batch numbers). Both require a bearer key with certificates:render. Each ZIP contains up to 10 PDFs and is limited to 4 MB.

MCP bots can use start_generation and list_generations. You can leave the page while the durable workflow runs. See progress and downloads in Settings → Usage. Downloads expire one hour after submission. Completed batches remain downloadable if a later batch fails. To retry a failed job, use a new UUID and only the recipients still needed; a new job reserves additional allowance.

New API keys are encrypted at rest and can be copied again from your signed-in account. Older hash-only keys cannot be recovered; create a replacement if repeat copying is needed.

Use a client that supports custom bearer headers. Clients requiring OAuth-only connection discovery need an OAuth adapter; Certinator does not currently provide OAuth authorization endpoints.

Keep generation lean

• Server generation uses your plan’s monthly and daily allowances, shared across all API keys and MCP. Read current limits from /api/v1/usage or Settings → Usage.
• Request rates depend on your plan; up to two concurrent rendering requests per account. Feature access is enforced server-side.
• Single PDF or ZIP response up to 4 MB; MCP embedded files up to 2 MB before encoding.
• Reuse saved branding and image assets. Ordinary render requests contain text and IDs, not repeated images.
• Rendering allowance counts attempts once reserved, even if the caller disconnects or output fails. A ZIP counts one certificate per item.
• Honor Retry-After on HTTP 429. Retry temporary failures with exponential backoff.

Automation platforms

Use an HTTP request step with bearer-header credentials, JSON input and binary output. Batch generation accepts {"items": [{"templateId": "classic", "details": {…}}]}. Direct rendering returns the file in the response; background generation returns a job ID for polling. Outgoing webhooks are not yet provided.