On-demand URLs

On-demand URLs let you embed a rendered document directly in an <img> tag, email, or link. The first request renders and caches; every request after is a CDN hit. No API key is required to fetch — the URL is HMAC-signed so it cannot be tampered with.

How it works

1. Generate a URL base for the template (one-time setup).
2. Sign a URL for a specific data payload via POST /api/v1/sign.
3. Use the URL anywhere — email, <img>, redirect, share link.

Behind the scenes, signing also pre-warms the render so the first visitor hits a cached file, not a cold render. You pay the credit at sign time; visitors pay nothing.

Generate a URL base

POST /api/v1/templates/{id}/url_base
Authorization: Bearer dg_your_api_key

Creates a random, opaque 16-character token for the template. If the template already has a url_base, this replaces it and invalidates every signed URL that used the old base.

Response — 200

{ "url_base": "Yx4kPz8qWm2nRv6t" }

Revoke a URL base

DELETE /api/v1/templates/{id}/url_base
Authorization: Bearer dg_your_api_key

Removes the token. Every signed URL for the template stops working immediately.

Response — 200

{ "url_base": null }

Sign a URL

POST /api/v1/sign
Authorization: Bearer dg_your_api_key
Content-Type:  application/json

Request body

Response — 200

{
  "url":           "https://automette.com/ondemand/Yx4kPz8qWm2nRv6t/image.pdf?data=...&s=...",
  "template_name": "Invoice",
  "format":        "pdf",
  "url_base":      "Yx4kPz8qWm2nRv6t"
}

• format is pdf for Typst templates and png for Canvas templates.
• The returned url is the final embed URL — paste into <img src>, email, or wherever.

Errors

Use the URL

<img src="https://automette.com/ondemand/Yx4kPz8qWm2nRv6t/image.pdf?data=...&s=..." />

The URL is fully public. No API key, no session cookie, no CORS. Subsequent fetches of the same URL hit the CDN cache.

When the URL changes vs caches

The signature is computed over (url_base, data, format). Two requests with the same data return the same signed URL — and hit the same cache key. Changing any field in data produces a new signed URL and a fresh render.

If you revoke and regenerate a url_base, every previously-signed URL stops working — even if the data is identical.

End-to-end example

# 1. Generate a URL base for the template (one-time)
curl -X POST https://automette.com/api/v1/templates/cm4tpl8e20001js04xq2v9k3m/url_base \
  -H "Authorization: Bearer dg_your_key"
# → { "url_base": "Yx4kPz8qWm2nRv6t" }

# 2. Sign a URL for this customer
curl -X POST https://automette.com/api/v1/sign \
  -H "Authorization: Bearer dg_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "template_id": "cm4tpl8e20001js04xq2v9k3m", "data": { "name": "Alice", "amount": "1,200" } }'
# → { "url": "https://automette.com/ondemand/Yx4kPz8qWm2nRv6t/image.pdf?data=...&s=...", ... }

# 3. Embed the URL
echo '<img src="https://automette.com/ondemand/Yx4kPz8qWm2nRv6t/image.pdf?data=...&s=..." />'