Getting Started

Three quick steps stand between you and your first call to the xTrakt API — mint a key in the platform, set the Authorization header on your requests, and POST a document.

What you will do

🔑

Generate a key

Create your API key from Developers → API Keys in the platform. Plaintext is shown only once.

🔒

Authenticate

Send the key on the Authorization header as a Bearer token on every request.

📄

Call an endpoint

POST a document as multipart/form-data and read the JSON envelope back.

Step by step

1

Open the API Keys page

After signing in to the platform, open the left-side navigation and go to Developers → API Keys.

2

Create a new key

Click the + New API Key button at the top right of the page.

A dialog will open asking for a name for the key. Use something descriptive — for example, the integration or environment that will consume it (production-erp, qa-import-job, etc.) — and click Generate.

3

Copy the plaintext key

The platform shows the plaintext value only once. It looks like xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c. Use the Copy button and store it in your secrets manager — after closing the dialog you will only see the masked form (xtkt_live_••••••••1a4f).

4

Manage existing keys

Back on the listing you will see every key with its name, masked value, creation date, last-used timestamp and status. Use the Revoke action to invalidate a key — revoked keys return 401 Unauthorized from the API.

:::warning The plaintext key is shown only at creation time If you lose it, revoke the key and generate a new one — the platform does not let you retrieve a plaintext key again. :::

Authenticate your requests

The xTrakt API uses the standard Authorization: Bearer <token> scheme. Replace the placeholder below with the key you just generated:

Authorization: Bearer xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c

There is no x-tenant header to send — the tenant is resolved from the key itself.

Minimal example — curl

curl -X POST "https://api-dev.xtrakt.ai/document/extraction" \
  -H "Authorization: Bearer xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c" \
  -F "file=@./invoice.pdf"

Minimal example — Python (requests)

import requests

API_KEY = "xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c"
BASE_URL = "https://api-dev.xtrakt.ai"

with open("invoice.pdf", "rb") as fp:
    response = requests.post(
        f"{BASE_URL}/document/extraction",
        headers={"Authorization": f"Bearer {API_KEY}"},
        files={"file": ("invoice.pdf", fp, "application/pdf")},
    )

response.raise_for_status()
print(response.json())

Minimal example — Node.js (fetch + FormData)

import fs from "node:fs";

const API_KEY = "xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c";
const BASE_URL = "https://api-dev.xtrakt.ai";

const form = new FormData();
form.append("file", new Blob([fs.readFileSync("./invoice.pdf")]), "invoice.pdf");

const response = await fetch(`${BASE_URL}/document/extraction`, {
  method: "POST",
  headers: { Authorization: `Bearer ${API_KEY}` },
  body: form,
});

console.log(await response.json());

Minimal example — C# (HttpClient)

using var http = new HttpClient { BaseAddress = new Uri("https://api-dev.xtrakt.ai") };
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "xtkt_live_5f4b8c2e3d1a4f7e9b6c0d8a1f2e3b4c");

using var form = new MultipartFormDataContent();
await using var fileStream = File.OpenRead("invoice.pdf");
var fileContent = new StreamContent(fileStream);
fileContent.Headers.ContentType = new MediaTypeHeaderValue("application/pdf");
form.Add(fileContent, name: "file", fileName: "invoice.pdf");

var response = await http.PostAsync("/document/extraction", form);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);

Common authentication errors

HTTP status	When it happens
401 Unauthorized	Header missing, malformed, key revoked, or key does not start with xtkt_live_.
403 Forbidden	Key is valid but the tenant does not have an active subscription for the requested operation.
429 Too Many Requests	API key exceeded the 50 requests/minute rate limit. Retry after a short backoff.

You are ready to call any endpoint listed in the API Reference.