Slipmint API docs

Slipmint turns JSON (or your own HTML) into a PDF. Everything on this page describes code that exists today. Anything else is marked planned.

Status

• The API code, templates, validation and quota counting are built and covered by automated smoke tests.
• PDF rendering is delegated to a self-hosted Gotenberg 8 (Chromium) renderer on Google Cloud Run. The API isn't open for public signups. Free API keys go out by invite to waitlist members. If no renderer is configured, POST /v1/pdf validates your input and returns 501.
• No service-level agreement or uptime commitment is offered.

Quickstart

Base URL: https://slipmint-api.mike-tusa.workers.dev

curl

BASE=https://slipmint-api.mike-tusa.workers.dev
export SLIPMINT_API_KEY=YOUR_API_KEY   # free keys go out by invite to waitlist members

curl -X POST "$BASE/v1/pdf" \
  -H "Authorization: Bearer $SLIPMINT_API_KEY" \
  -H "Content-Type: application/json" \
  -o invoice.pdf \
  -d '{"template_id":"invoice","data":{"company_name":"Northwind Studio","brand_color":"#0f766e",
       "invoice_number":"INV-1042","issue_date":"2026-09-25","customer_name":"Acme Corp",
       "currency":"USD","tax_rate":8.25,
       "items":[{"description":"Website redesign","quantity":1,"unit_price":4500}]}}'

# Your own HTML instead of a template:
curl -X POST "$BASE/v1/pdf" -H "Authorization: Bearer $SLIPMINT_API_KEY" \
  -H "Content-Type: application/json" -o page.pdf \
  -d '{"html":"<h1>Hello</h1><style>@page{size:Letter}</style>","filename":"page.pdf"}'

# Check the rendered HTML without using a document from your quota:
curl -X POST "$BASE/v1/pdf?preview=html" -H "Authorization: Bearer $SLIPMINT_API_KEY" \
  -H "Content-Type: application/json" -d @invoice.json -o preview.html

JavaScript (Node 18+, ESM)

import { writeFile } from "node:fs/promises";

const BASE = "https://slipmint-api.mike-tusa.workers.dev";
const res = await fetch(`${BASE}/v1/pdf`, {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.SLIPMINT_API_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    template_id: "certificate",
    data: {
      recipient_name: "Ada Lovelace", course_name: "Intro to Analytics",
      issued_date: "September 25, 2026", issuer_name: "Example Academy",
      brand_color: "#b45309", font: "EB Garamond", page_size: "Letter",
    },
  }),
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
console.log("usage:", res.headers.get("X-Slipmint-Usage"));
await writeFile("certificate.pdf", Buffer.from(await res.arrayBuffer()));

Python (requests)

import os, requests

BASE = "https://slipmint-api.mike-tusa.workers.dev"
resp = requests.post(
    f"{BASE}/v1/pdf",
    headers={"Authorization": f"Bearer {os.environ['SLIPMINT_API_KEY']}"},
    json={
        "template_id": "report",
        "data": {
            "company_name": "Brightline Agency", "report_title": "Monthly Report",
            "period": "September 2026", "brand_color": "#1d4ed8",
            "kpi_1_label": "Sessions", "kpi_1_value": "48,210",
            "summary": "First paragraph.\n\nSecond paragraph.",
            "rows": [{"label": "Organic", "value": "22,140"}, {"label": "Direct", "value": "12,030"}],
        },
    },
    timeout=60,
)
if resp.status_code != 200:
    raise SystemExit(f"{resp.status_code}: {resp.text}")
open("report.pdf", "wb").write(resp.content)

Authentication

Every /v1/* request needs Authorization: Bearer <api key>. Keys are stored only as SHA-256 hashes, so a lost key can't be recovered and has to be replaced. The pages /, /docs, /gallery/* and /health are public.

POST /v1/pdf

JSON body with exactly one of:

Response: 200 application/pdf with the header X-Slipmint-Usage: <used>/<included>. With ?preview=html you get 200 text/html instead, and it isn't counted.

Templates & tokens

All text values are HTML-escaped before they go into the template, so you can't inject markup through data. GET /v1/templates returns this same information as JSON, including sample data.

Invoice invoice (portrait)

Branded invoice with line items, computed subtotal/tax/total, status badge, payment details and notes. Preview

Receipt receipt (portrait)

Payment receipt card with amount paid, payment method, line items and totals. Preview

Simple report report (portrait)

One- or two-page report: branded cover band, three KPIs, summary paragraphs and a data table. Preview

Certificate certificate (landscape)

Landscape certificate of completion with double brand border, seal and signature lines. Preview

Template gallery

Live previews rendered with sample data by the same code path as the PDF (open one full-size to print-preview it). Every name and number is made up.

Query options: ?page_size=A4|Letter and ?brand_color=7c3aed (hex without #).

Branding & page size

• brand_color: a hex color used for headers, accents, table heads and the certificate border. Text placed on brand-colored areas switches between black and white automatically for WCAG contrast.
• logo_url: an https:// or data:image/ URL. If it's empty, the logo slot is hidden.
• font: the font family name. The certificate defaults to EB Garamond, which is bundled (SIL Open Font License) and embedded in the document, so it always renders; you can also use it on other templates with "font": "EB Garamond". Other fonts have to be installed on the renderer: the Gotenberg 8 image ships Noto, DejaVu, Liberation (metric-compatible with Arial/Helvetica/Times), Carlito and Caladea. Unknown names fall back to the template's sans-serif or serif stack.
• page_size: A4 (default) or Letter. It's applied through CSS @page, and the renderer is called with preferCssPageSize=true. Certificates are landscape.

Other endpoints

Errors

Limits & quotas

• A document is counted only when a PDF is returned successfully. The count is reserved atomically before rendering and refunded if the render fails.
• Usage resets on the 1st of each month (UTC).
• Maximum html size is 2 MB, and items / rows are capped at 200 entries.

Pricing (planned)

No payments are taken yet. Brand limits aren't enforced in the API yet, because branding is sent per request.

Privacy & retention

Summary (the full policy is at /privacy):

• Documents are processed transiently and streamed back in the response. They aren't retained in any database or file storage.
• The API runs on Cloudflare Workers. The renderer runs on Google Cloud Run (us-central1, USA), where Gotenberg's temporary working files live in Cloud Run's in-memory filesystem and are removed when the request finishes.
• We store a SHA-256 hash of each API key, its label and plan, and a document count per key per month.
• We never log request bodies, rendered output or API keys. The hosting providers record standard request metadata (time, IP address, path, status).
• Requests that reference private, loopback, link-local or cloud-metadata addresses are rejected where detected; the renderer blocks private IPs at fetch time. Report security issues: digitalpromohub.support+slipmint@gmail.com.

API keys

Free API keys (50 documents per month) go out by invite to waitlist members. Join the waitlist on the home page and we'll send you one launch invite, in batches, with a personal, single-use link that creates your key. The link expires after 7 days, and the key is shown only once. See privacy §6 and §6a for what's stored and how to delete it.

Use of the API is subject to the beta terms.