Edit, Watermark and Password-Protect PDFs in Node.js

This guide demonstrates text replacement, visible watermarking, PDF passwords, and rendering pages as images. These operations have different purposes. A watermark or an image-based copy does not make visible confidential information safe to distribute.

The examples below are independent operations, not five successive levels of protection.

Prerequisites

• A PDF.co account and API key.
• A supported Node.js LTS release.
• An unencrypted source PDF at a URL accessible to PDF.co.

Use a current source URL you control. Keep the source accessible throughout processing.

Set your API key in the terminal where you will run the examples.

On macOS or Linux:

export PDFCO_API_KEY="YOUR_PDFCO_API_KEY"

In PowerShell:

$env:PDFCO_API_KEY = "YOUR_PDFCO_API_KEY"

Create the Script

Save this complete script as pdf-tools.cjs. It provides five operations through one shared request-and-download routine.

const { writeFile } = require("node:fs/promises");

function requiredEnv(name) {
  const value = process.env[name];
  if (!value || !value.trim()) throw new Error(`Set ${name} first.`);
  return value;
}

async function main() {
  const [operation, sourceUrl] = process.argv.slice(2);
  const configs = {
    replace: {
      path: "/v1/pdf/edit/replace-text",
      file: "replaced.pdf",
      payload: {
        searchStrings: ["Your Company Name", "Client Name", "Item"],
        replaceStrings: ["XYZ LLC", "ACME", "SKU"],
        regex: false
      }
    },
    watermark: {
      path: "/v1/pdf/edit/add",
      file: "watermarked.pdf",
      payload: {
        images: [{
          url: process.env.PDFCO_WATERMARK_URL,
          x: 400, y: 20, width: 119, height: 32, pages: "0-"
        }]
      }
    },
    protect: {
      path: "/v1/pdf/security/add",
      file: "protected.pdf",
      payload: {
        encryptionAlgorithm: "AES_256bit",
        allowAccessibilitySupport: true,
        allowPrintDocument: true,
        allowAssemblyDocument: false,
        allowFillForms: false,
        allowModifyDocument: false,
        allowContentExtraction: false,
        allowModifyAnnotations: false
      }
    },
    rasterize: {
      path: "/v1/pdf/makeunsearchable",
      file: "image-only.pdf",
      payload: { pages: "0-" }
    },
    jpg: {
      path: "/v1/pdf/convert/to/jpg",
      images: true,
      payload: {
        pages: "0-",
        inline: false,
        profiles: JSON.stringify({ RenderingResolution: 150 })
      }
    }
  };

  if (!Object.hasOwn(configs, operation) || !sourceUrl) {
    throw new Error(
      "Usage: node pdf-tools.cjs replace|watermark|protect|rasterize|jpg SOURCE_URL"
    );
  }

  const config = configs[operation];
  const apiKey = requiredEnv("PDFCO_API_KEY");

  if (operation === "watermark") requiredEnv("PDFCO_WATERMARK_URL");

  if (operation === "protect") {
    config.payload.ownerPassword = requiredEnv("PDFCO_OWNER_PASSWORD");
    config.payload.userPassword = requiredEnv("PDFCO_USER_PASSWORD");

    if (config.payload.ownerPassword === config.payload.userPassword) {
      throw new Error("Use different owner and user passwords.");
    }
  }

  const response = await fetch("https://api.pdf.co" + config.path, {
    method: "POST",
    headers: {
      "x-api-key": apiKey,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      url: sourceUrl,
      async: false,
      ...(config.file ? { name: config.file } : {}),
      ...config.payload
    }),
    signal: AbortSignal.timeout(60000)
  });

  const result = await response.json();

  if (!response.ok || result.error || result.jobId) {
    throw new Error(
      result.message || "Expected a completed synchronous result."
    );
  }

  const urls = config.images
    ? result.urls
    : (result.url ? [result.url] : []);

  if (
    !Array.isArray(urls) ||
    !urls.length ||
    urls.some(url => typeof url !== "string" || !url)
  ) {
    throw new Error("No valid output URL list was returned.");
  }

  for (const [index, url] of urls.entries()) {
    const downloaded = await fetch(url, {
      signal: AbortSignal.timeout(60000)
    });

    if (!downloaded.ok) {
      throw new Error(`Download failed: ${downloaded.status}`);
    }

    const destination = config.images
      ? `page-${index + 1}.jpg`
      : config.file;

    await writeFile(
      destination,
      Buffer.from(await downloaded.arrayBuffer()),
      { flag: "wx" }
    );

    console.log(
      `Saved ${destination}. Inspect the output before sharing it.`
    );
  }
}

main().catch(error => {
  console.error(error.message);
  process.exitCode = 1;
});

The script reads the complete JSON response before parsing it and checks each download before saving it. Output requests do not include your PDF.co API key.

Run the examples in a working folder where their output filenames do not already exist. The script will not overwrite existing files.