Developer API
KovaPDF API changelog
What changed in the API, newest first. Changes that need anything from you say so. The reference and the OpenAPI file always describe the API as it is now.
Test keys, live keys, tasks and safe retries
- Two kinds of key. A free test key (
kova_test_) that you make yourself runs 10 tasks within 14 days; its signing emails go only to your own address, its PDFs are stamped TEST, and its signature requests are deleted after 7 days. A live key (kova_live_) works once API access is on for your account. - Every answer to a test key carries
KovaPDF-Mode: testandKovaPDF-Test-Tasks-Left, and its JSON has"mode": "test". - Tasks: one signature request made, one verification or one digital signing. Reading, listing and status calls are not tasks, and failed calls are not counted. Live access has a monthly task limit (
429 monthly_limit) or a pack of tasks (429 credits_used), with no overage. - Every POST takes an
Idempotency-Key. Answers are kept for 24 hours. New codes:invalid_idempotency_key,idempotency_key_reused,idempotency_in_progress. - IP allow lists on keys (
403 ip_not_allowed), and keys that pause themselves on a burst of tasks or too many bounced emails (403 key_paused). - A live call from an account without API access gets
402 api_access_required. Keys made before this change (kova_) keep working for 30 days, with aKovaPDF-Key-Noticeheader that gives the date. - New codes for the end of a test:
test_key_used_up,test_key_expiredandtest_monthly_limit. - OpenAPI file version 1.6, a Postman collection, a page of every error code, the request form for API access, and the API terms. The reference moved to /developers/docs with the same anchors.
Scopes, expiry, daily caps, workspace keys and the OpenAPI file
- Each key is made with the scopes it needs. A call outside them gets
403 insufficient_scope, naming the scope. Keys made before scopes existed have all four. - Keys can expire after 1 to 366 days, or never, with an email 7 days before. An expired key gets
401 expired_api_key. - A daily cap per key, the lower of your own cap and your plan's, with
429 daily_limit. Every 429 has aRetry-Afterheader. - Keys in Team and Business workspaces, including keys that belong to the workspace itself and keep working when their maker leaves.
- The whole API described in one OpenAPI 3.1 file, on this website and at
/api/v1/openapi.json.
By 22 October 2026
The first version
- Signature requests: send, list, read, remind, cancel and download, with the same checks as the website.
- Digital signing with your own
.pfxor.p12certificate, and verification of the signatures in a PDF. - Webhooks for every change to a signature request, signed with HMAC-SHA256 in the
KovaPDF-Signatureheader and retried on failure. - 60 calls a minute and 30 signature requests sent an hour per key.
What you need to do after 29 October 2026: if you use a key made before that day, make a test key to keep trying the API, and ask for API access to keep using it with real documents after the 30 days.