Toolorah API

Quickstart

Every tool lives at the endpoint shown below. Send your API key as a bearer token and a JSON body containing input and options. Here is the same call in three languages: POST /api/v1/<tool> { input, options }

curl -X POST https://www.toolorah.com/api/v1/base64 \
  -H "Authorization: Bearer nt_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"input":"hello world","options":{"mode":"encode"}}'

const res = await fetch("https://www.toolorah.com/api/v1/base64", {
  method: "POST",
  headers: {
    "Authorization": "Bearer nt_live_xxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ input: "hello world", options: { mode: "encode" } }),
});
const data = await res.json();
console.log(data.result); // "aGVsbG8gd29ybGQ="

import requests

res = requests.post(
    "https://www.toolorah.com/api/v1/base64",
    headers={"Authorization": "Bearer nt_live_xxx"},
    json={"input": "hello world", "options": {"mode": "encode"}},
)
print(res.json()["result"])  # aGVsbG8gd29ybGQ=

Authentication

Create a key on your API keys page, then send it as a bearer token on every request: Get your API key

Authorization: Bearer nt_live_xxxxxxxxxxxxxxxx

Keys carry the permissions of the plan they were created under. Treat them like passwords — keep them server-side, and revoke any key that leaks from the keys page.

Requests & responses

All endpoints use POST and accept a JSON body with two fields:

• input — the text (or, for PDF tools, base64 file) to process.
• options — a per-tool object of settings. Optional; sensible defaults apply.

A successful call returns 200 with this envelope:

{
  "tool": "base64",
  "result": "aGVsbG8gd29ybGQ=",
  "meta": { }
}

Errors return a non-2xx status with a single error field:

{ "error": "Invalid or revoked API key." }

Rate limits

• Pro — 1,000 calls/day
• Elite — 10,000 calls/day

Limits reset at 00:00 UTC. Every response includes your current budget:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 942

Once you are over the limit, calls return 429 with a Retry-After header. Malformed requests do not count against your quota.

Batch requests

Process many inputs in a single request instead of looping one HTTP call per item. Send inputs as an array of strings; options apply to every item. Available on Pro (25 inputs per request) and Elite (250).

curl -X POST https://www.toolorah.com/api/v1/base64/batch   -H "Authorization: Bearer nt_live_..."   -H "Content-Type: application/json"   -d '{"inputs":["hello","world"],"options":{"mode":"encode"}}'

{
  "tool": "base64",
  "count": 2,
  "succeeded": 2,
  "failed": 0,
  "results": [
    { "index": 0, "result": "aGVsbG8=" },
    { "index": 1, "result": "d29ybGQ=" }
  ]
}

Each input costs one call from your daily quota — batching saves round-trips, not quota. A batch that would cross your daily limit is rejected whole and nothing is processed, so you never get a half-finished result set.

Results come back in the same order as the inputs, each tagged with its index. One bad input does not discard the rest: it returns an error field for that index while every other result succeeds. Check succeeded and failed on the envelope.

Utility endpoints

Two GET endpoints for discovering what you can call and how much budget you have left. Both need the same bearer key.

{
  "plan": "pro",
  "daily": { "limit": 1000, "used": 42, "remaining": 958 },
  "batch": { "maxInputsPerRequest": 25 },
  "resetsAt": "2026-08-24T00:00:00.000Z"
}

Endpoints

Text and utility tools. Pass the listed options to control behaviour.

PDF endpoints

PDF tools work on files, so requests carry base64-encoded files in the JSON body and the response result is the base64 output PDF. Keep total decoded payload under about 4 MB per request. WebP images are browser-only — send PNG or JPG to the API.

# Merge two PDFs (bash)
curl -X POST https://www.toolorah.com/api/v1/pdf-merger \
  -H "Authorization: Bearer nt_live_xxx" \
  -H "Content-Type: application/json" \
  -d "{\"files\":[\"$(base64 -w0 a.pdf)\",\"$(base64 -w0 b.pdf)\"]}" \
  | jq -r '.result' | base64 -d > merged.pdf

Errors

• 401 — missing or invalid API key
• 403 — your plan has no API access
• 404 — unknown tool
• 422 — bad input (for example invalid JSON or regex)
• 429 — daily limit reached