Changelog

Release history for the Airpdf Render API and official SDKs.

We use Semantic Versioning per artifact. The HTTP API and each SDK version independently.

MCP server · v1.0.0 — 2026-05

First public release of the Airpdf MCP server — an OAuth 2.1-compliant authorisation server + JSON-RPC tool transport that exposes template management to MCP-aware clients (Claude Desktop, Cursor, …). See Connect to Claude / Cursor (MCP) and the tool reference.

Discovery

• GET /.well-known/oauth-authorization-server — RFC 8414 metadata
• GET /.well-known/oauth-protected-resource — RFC 9728 metadata

Authorisation

• POST /mcp/oauth/register — RFC 7591 Dynamic Client Registration (public clients only, auth_method: none), rate-limited 10/min per IP
• GET /mcp/oauth/authorize + POST /mcp/oauth/consent — auth-code flow with PKCE S256 mandatory (OAuth 2.1 §7.5.2 — plain rejected)
• POST /mcp/oauth/token — authorization_code + refresh_token grants, JSON {access_token, refresh_token, expires_in, scope}

Token lifecycle

• Access tokens: opaque mcp_live_…, 1 hour TTL, enforced by McpAuthPlug
• Refresh tokens: opaque mcp_refresh_…, 30 day TTL, single-use rotated
• Reuse detection (RFC 6749 §10.4) — replaying a rotated-past refresh revokes the entire connection
• Resource indicators (RFC 8707) — clients can declare the resource URI on /authorize; stored on McpConnection.aud, optionally enforced by McpAuthPlug against the request origin

Tool surface

8 tools, all per-workspace, all going through the same Authorization: Bearer … plug as the REST API:

Operations

• Per-connection rate limit: 120 tool calls / min (tunable)
• Hourly Oban sweep auto-revokes connections whose refresh token has expired
• Backoffice Settings → AI Connections lists active + revoked grants with token prefix, expiry, audience, and last-used timestamp

Spec compliance

OAuth 2.0 (RFC 6749) · PKCE (RFC 7636) · OAuth 2.1 §7.5.2 · DCR (RFC 7591) · ASM (RFC 8414) · Resource Indicators (RFC 8707) · Protected Resource Metadata (RFC 9728) · MCP protocol 2025-03-26

API · v1.0.0 — 2026-05 (preview)

First public release.

Endpoints

• POST /api/v1/render — sync (binary or URL) and async (with webhook) render
• GET /api/v1/render/:id — poll render status
• GET /api/v1/templates — list active templates in workspace
• GET /api/v1/templates/:slug — get a single template + variables schema

Auth

• Bearer tokens with airpdf_live_* (production) and airpdf_test_* (sandbox) prefixes
• Per-key rate limit tied to workspace plan

Webhooks

• HMAC-SHA256 signed deliveries on render.succeeded / render.failed
• Replay protection via X-Airpdf-Timestamp (5 min tolerance)
• No retries yet — single-attempt delivery (retries planned for v1.1)

Storage

• Service-managed: Wasabi eu-central-1 with 1h presigned URLs
• Customer-owned: S3 / R2 / MinIO / Wasabi / S3-compatible
• Credentials encrypted at rest (AES-GCM via Cloak)

SDKs · v0.1.0 — 2026-05 (preview)

Initial release for all 12 SDKs simultaneously.

Tier 1 (officially maintained)

• @airpdf/sdk (npm, Node 18+)
• airpdf-sdk (PyPI, Python 3.9+)
• github.com/zoonect/airpdf-sdk-go (Go 1.22+)
• airpdf-sdk (RubyGems, Ruby 3.0+)

Tier 2 (community / preview)

• airpdf/sdk (Composer, PHP 8.1+)
• Airpdf.Sdk (NuGet, .NET 8 / netstd 2.1)
• it.airpdf:airpdf-sdk (Maven Central, Java 17+)
• airpdf_sdk (Hex, Elixir 1.15+)

Tier 3 (experimental, not yet published)

• Rust, Kotlin, Swift, Dart — reference implementations in the monorepo

Common surface

All SDKs ship: render, renderAsync, getRender, waitForRender, verifyWebhook, plus uniform error classes.

Editor · 2026-04

• REPL-style JSX editor (CodeMirror 6 + one-dark theme)
• Client-side JSX → JSON tree compilation (acorn + acorn-jsx)
• Whitelisted primitives: Document, Page, View, Text, Image, List
• Live PDF preview via @react-pdf/renderer browser build
• Variables manager (JSON Schema) in collapsible drawer

Platform · 2026-04

• 12 starter templates (Invoice, Report, Letter, Badge, Receipt, …)
• Multi-tenant with per-workspace Postgres schemas
• Stripe billing with 6 tiers (Free → Enterprise)
• Honeybadger error reporting
• Mailgun transactional email
• Status page at airpdf.app/status

Roadmap (not committed)

Things we're considering — order and timing subject to change.

• HTML→PDF endpoint (POST /api/v1/render-html) for DocRaptor migration paths
• Webhook retries with exponential backoff
• Idempotency-Key header support
• Templates v2: server-side variable defaults, computed fields, locale-aware formatting
• Multi-region render pool (US + EU)
• SSO (SAML, OIDC) for Enterprise
• Audit log for security-conscious workspaces
• Tier 3 SDKs to Tier 2 as we publish to registries

Email hello@airpdf.app if you'd like to influence priority — what would unblock you?