Business — entry 007 of 18
Invovate
Invovate's `POST /api/generate-invoice` takes one JSON payload (line items, taxes, discounts, currency, language) and computes totals server-side, returned as JSON, a rendered PDF, or UBL 2.1 XML — confirmed live with an anonymous JSON request that returned a fully computed 200 response with no key required. A follow-up request for `"output":"pdf"` without a key returned a 403 `auth_required` ("PDF/UBL output requires a free API key"), confirming PDF/UBL needs a bearer token while JSON stays key-free and IP-rate-limited. Both a plain GET-style call and a separate OPTIONS preflight, each sent with a third-party `Origin` header, got back a fixed `access-control-allow-origin: https://invovate.com` rather than an echoed origin, so cross-origin browser calls from other sites are blocked.
Invovate generates invoices from JSON. Its JSON output mode needs no account: send an invoice body and it returns the computed totals right away. A free API key is only needed for PDF or UBL XML output. A live anonymous POST this run against /generate-invoice returned a full computed invoice with zero credentials sent.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/invovate/"><img src="https://greatapis.com/badge/invovate.svg" alt="Scored 67 on greatapis.com"></a>Auth quickstart
- For JSON output, send no
Authorizationheader at all. A live anonymousPOSTthis run tohttps://invovate.com/api/generate-invoicewith a plain invoice body returned200and a fully computed invoice, marked"anonymous":truein the response. - For PDF or UBL XML output, add
"output":"pdf"(or"ubl") to the same body and send a free API key asAuthorization: Bearer <key>. Get the key by signing up at invovate.com. - A live call this run with
"output":"pdf"and no key returned403with{"success":false,"error":{"code":"auth_required","message":"PDF/UBL output requires a free API key. Sign up to enable it."}}.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Anonymous JSON invoice
POSThttps://invovate.com/api/generate-invoice
Content-Type: application/json
{"from":{"name":"Acme LLC"},"to":{"name":"Globex Corp"},"items":[{"description":"Consulting","quantity":2,"unit_price":100}]}{"success":true,"invoice":{"number":"INV-1787270905045","title":null,"date":"2026-08-21","due_date":null,"po_number":null,"terms":null,"currency":"USD","language":"en","template":"classic","accent_color":null,"tax_inclusive":false,"from":{"name":"Acme LLC","address":"","email":"","phone":"","tax_id":"","registration_no":"","website":"","logo":null},"to":{"name":"Globex Corp","address":"","email":"","phone":"","tax_id":""},"ship_to":null,"items":[{"description":"Consulting","quantity":2,"unit":null,"unit_price":100,"discount":0,"taxes":[],"tax_rate":0,"tax_amount":0,"line_total":200}],"subtotal":200,"discount_total":0,"global_discount":0,"shipping":0,"shipping_label":"Shipping","tax_lines":[],"total_tax":0,"rounding_adjustment":0,"grand_total":200,"deposit":0,"amount_paid":0,"balance_due":200,"status":"unpaid","payment":{"pay_to":"","bank_name":"","account_name":"","account_number":"","routing_number":"","iban":"","swift":"","instructions":"","method_note":"","qr":null},"signature":null,"notes":null,"refund_policy":null,"footer":null},"anonymous":true}The API fills in the totals: subtotal, grand_total, and balance_due all came back as 200 for a 2-unit, $100 line item, and it minted an invoice number on its own. Fields you did not send, like email or address, come back as empty strings, not omitted.
Developer reference
Free tier: 40 API calls/hour, 400/week, 100 documents/month (max 50 PDFs); paid: Starter $9/mo 200/hr & 4,000/week, Pro $29/mo 1,000/hr & 40,000/week, Enterprise unlimited; enforced via X-RateLimit-Limit-Hourly/-Weekly headers with HTTP 429 on breach
Gotchas & limits
- Adding
"output":"pdf"or"output":"ubl"without a key does not degrade to JSON. A live call this run returned a hard403 auth_requiredinstead. access-control-allow-originis fixed tohttps://invovate.com, not echoed to the caller's origin. A browserfetch()from any other site is blocked by CORS, even for the anonymous JSON path.- The stored rate-limit text says limits are enforced through
X-RateLimit-Limit-HourlyandX-RateLimit-Limit-Weeklyresponse headers. A live anonymous call this run carried none of those headers at all, so do not rely on them to track usage on the anonymous path.