Developers
The same engines, over HTTP
JSON in, JSON out. Authenticate with an X-Api-Key header. The free tier includes 1,500 calls per month — enough for a side project to ship.
Authentication
Every request needs a key. Keys are issued per plan and can be rotated without changing your account. Treat a key like a password: keep it server-side and revoke it immediately if it leaks.
X-Api-Key: tf_live_xxxxxxxxxxxxxxxxxxxxKey in header
Never in the query string, so keys stay out of logs and browser history.
Fast responses
Utility endpoints answer in milliseconds; PDF jobs depend on document size.
No body logging
Request bodies are processed in memory and discarded after the response.
PDF manipulation
/api/v1/pdf/compress
Compress a PDF. Body: file, quality (screen | ebook | printer | prepress).
/api/v1/pdf/merge
Merge 2–20 PDFs into one document. Body: files[].
/api/v1/pdf/split
Split by page range. Body: file, ranges.
/api/v1/pdf/to-word
Convert a PDF into DOCX. Body: file.
/api/v1/pdf/to-image
Render pages as images. Body: file, format, dpi.
/api/v1/pdf/unlock
Remove a password you own. Body: file, password.
/api/v1/pdf/protect
Encrypt a PDF. Body: file, password, permissions.
Utility endpoints
/api/v1/util/qr
Generate a QR code. Body: text, size, format (png | svg), colours.
/api/v1/util/hash
Hash text or a file. Body: text, algorithm (md5 | sha1 | sha256 | sha384 | sha512).
/api/v1/util/uuid
Generate UUIDs. Query: version (4), count (max 100).
/api/v1/util/base64
Encode or decode Base64. Body: text, mode.
/api/v1/util/password
Generate a password. Body: length, character sets.
Network intelligence
/api/v1/ip/lookup
Geo and network data for an IP. Query: ip (optional).
/api/v1/domain/dns
DNS records. Query: domain, type (A | AAAA | MX | TXT | CNAME | NS | SOA).
/api/v1/domain/ssl
Certificate history for a hostname. Query: domain.
/api/v1/domain/whois
Registration data via RDAP. Query: domain.
Quick start
Pick your language. Replace the key with one from your dashboard.
curl -X POST "https://toolflow.app/api/v1/util/hash" \
-H "X-Api-Key: tf_live_your_key" \
-H "Content-Type: application/json" \
-d '{"text":"hello world","algorithm":"sha256"}'Response shape
Success and error responses share a predictable envelope, so you can branch on success once.
{
"success": true,
"data": {
"result": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
"algorithm": "sha256"
},
"meta": {
"plan": "free",
"calls_limit": 1500,
"calls_used": 42,
"request_id": "req_01HX9Z..."
}
}{
"success": false,
"error": {
"code": "RATE_LIMIT_EXCEEDED",
"message": "Monthly API call limit exceeded. Please upgrade your plan."
}
}