Skip to Content
FAQ

FAQ

Which key do I use where?

Secret key (sk_live_…) on servers, public key (pk_live_…) in browsers. The secret key has full organization access and must never be shipped to a client. The public key is safe in the browser because requests additionally require an allowed Origin and a signed user identity (x-user-id + x-user-hash), and are scoped to that one user. Details: Frontend rendering.

Why am I getting 401?

The message tells you exactly which check failed — see the error catalog. The most common ones:

  • Invalid API key — typo, or the key was invalidated by rotation.
  • Domain <hostname> is not in allowedDomains — add your site under Settings → Allowed domains.
  • Invalid x-user-hash — the hash wasn’t computed with your current signing secret for that exact user ID. Recompute with signUserId(userId, signingSecret) on your backend.
  • Public key requires Origin header — you used the public key from server-side code; use the secret key there.

Why can’t I render my template?

400 Template is not published — templates start as drafts and must be published first (dashboard, or POST /v1/templates/:id/publish). If you get 404 Template not found, check the ID and that the key belongs to the same organization. See Template lifecycle.

My XLSX render fails with “No table sections found”

XLSX output is built from table sections only. Add a table section to the template (and enable the XLSX format), or render PDF instead. See Sections & variables.

How long does a downloadUrl live?

It’s a presigned storage URL, valid for about an hour by default. Don’t store it — store the documentId and call GET /v1/downloads/:id any time for a fresh 302-redirected link.

What are the rate limits?

100 requests per minute per API key, across all endpoints. Over the limit you get 429 — back off and retry.

Can I create templates through the API?

Yes — POST /v1/templates accepts the full template shape (name, formats, sections; see the interactive reference ). In practice, build templates in the dashboard : sections are deeply nested and the visual builder is the supported authoring path. Rendering and reading templates is what the SDK is for.

Where’s the full endpoint documentation?

The interactive, always-current reference generated from the API itself: api.reforg.io/api/v1 . The overview here maps the surface.

I rotated my keys and everything broke

That’s by design — rotation regenerates all three credentials (public key, secret key, signing secret) and invalidates the old ones immediately. Update REFORGIO_SECRET_KEY, the public key in your frontend, and the signing secret used by signUserId, then redeploy.

Errors