Toolorah API

Quickstart

Every tool lives at the endpoint shown below. Send your API key as a bearer token and a JSON body containing input and options. Here is the same call in three languages: POST /api/v1/<tool> { input, options }

curl -X POST https://toolorah.com/api/v1/base64 \
  -H "Authorization: Bearer nt_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"input":"hello world","options":{"mode":"encode"}}'

const res = await fetch("https://toolorah.com/api/v1/base64", {
  method: "POST",
  headers: {
    "Authorization": "Bearer nt_live_xxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ input: "hello world", options: { mode: "encode" } }),
});
const data = await res.json();
console.log(data.result); // "aGVsbG8gd29ybGQ="

import requests

res = requests.post(
    "https://toolorah.com/api/v1/base64",
    headers={"Authorization": "Bearer nt_live_xxx"},
    json={"input": "hello world", "options": {"mode": "encode"}},
)
print(res.json()["result"])  # aGVsbG8gd29ybGQ=

Authentication

Create a key on your API keys page, then send it as a bearer token on every request: Get your API key

Authorization: Bearer nt_live_xxxxxxxxxxxxxxxx

Keys carry the permissions of the plan they were created under. Treat them like passwords — keep them server-side, and revoke any key that leaks from the keys page.

Requests & responses

All endpoints use POST and accept a JSON body with two fields:

• input — the text (or, for PDF tools, base64 file) to process.
• options — a per-tool object of settings. Optional; sensible defaults apply.

A successful call returns 200 with this envelope:

{
  "tool": "base64",
  "result": "aGVsbG8gd29ybGQ=",
  "meta": { }
}

Errors return a non-2xx status with a single error field:

{ "error": "Invalid or revoked API key." }

Rate limits

• Pro — 1,000 calls/day
• Elite — 10,000 calls/day

Limits reset at 00:00 UTC. Every response includes your current budget:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 942

Once you are over the limit, calls return 429 with a Retry-After header. Malformed requests do not count against your quota.

Endpoints

Text and utility tools. Pass the listed options to control behaviour.

PDF endpoints

PDF tools work on files, so requests carry base64-encoded files in the JSON body and the response result is the base64 output PDF. Keep total decoded payload under about 4 MB per request. WebP images are browser-only — send PNG or JPG to the API.

# Merge two PDFs (bash)
curl -X POST https://toolorah.com/api/v1/pdf-merger \
  -H "Authorization: Bearer nt_live_xxx" \
  -H "Content-Type: application/json" \
  -d "{\"files\":[\"$(base64 -w0 a.pdf)\",\"$(base64 -w0 b.pdf)\"]}" \
  | jq -r '.result' | base64 -d > merged.pdf

Errors

• 401 — missing or invalid API key
• 403 — your plan has no API access
• 404 — unknown tool
• 422 — bad input (for example invalid JSON or regex)
• 429 — daily limit reached