Authentication

Penvio supports multiple authentication methods for both the web application and API.

Web Application

Email & Password

The simplest way to get started:

1. Go to Sign Up 
2. Enter your name, email, and password (minimum 8 characters)
3. Verify your email address
4. Sign in at the Login page 

Google OAuth

For faster sign-in:

1. Click “Sign in with Google” on the login page
2. Select your Google account
3. Grant permission for Penvio to access your basic profile

Enterprise SSO

Business and Enterprise plans support SAML 2.0 SSO:

1. Contact your administrator to configure SSO
2. Access Penvio through your organization’s identity provider
3. You’ll be automatically signed in

API Authentication

For programmatic access, the API uses bearer token authentication.

Getting Your API Token

1. Sign in to Penvio
2. Go to Settings → API
3. Click Generate API Key
4. Copy and securely store your key

Using Your API Token

Include your token in the Authorization header:

curl -X GET https://penvio.io/api/documents \
  -H "Authorization: Bearer YOUR_API_TOKEN"

const response = await fetch('https://penvio.io/api/documents', {
  headers: {
    'Authorization': 'Bearer YOUR_API_TOKEN',
  },
});
 
const data = await response.json();

import requests
 
response = requests.get(
    'https://penvio.io/api/documents',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)
 
data = response.json()

Token Security Best Practices

1. Use environment variables - Never hardcode tokens in your code
2. Rotate regularly - Generate new tokens periodically
3. Use separate tokens - Create different tokens for different environments
4. Monitor usage - Review API activity in the dashboard

Session Cookies

If you’re building a browser-based integration, you can also use session cookies:

1. Direct users to the Penvio login page
2. After login, the session cookie is automatically set
3. Subsequent requests include the session cookie

This is useful for embedding Penvio in an iframe or building browser extensions.

Rate Limits by Authentication

See Rate Limits for more details.

Troubleshooting

”Unauthorized” (401) Error

• Check that your token is correct and hasn’t expired
• Verify the Authorization header format: Bearer YOUR_TOKEN
• Ensure your subscription includes API access

”Forbidden” (403) Error

• Your account may not have access to the requested resource
• Check that the document belongs to your organization

Session Expired

Web sessions expire after 30 days of inactivity. Simply sign in again to continue.

Next Steps

• Account Setup - Configure your profile and security settings
• Authentication Setup - Set up 2FA and manage sessions
• Plans & Pricing - Choose a plan with API access