Node.js PDF Encryption for Property Bundles — Out-of-Band Password Delivery

Short answer: In Node.js, encrypt the finished PDF, store it privately, deliver the document reference, and send its password through a separate channel that identifies the document by name.

A property manager pages the platform team because a tenant's merged lease bundle was delivered but the password was not. The tempting response is to resend everything through the same email thread. Do not do that. The two channels are the security property. Collapsing them turns encryption into decoration.

For a Node.js/Express service, keep the HTTP handler thin and make delivery a state machine: assemble the bundle, encrypt it, persist it, record that encryption happened, publish the document notification, then publish the password notification on another channel. Never put the password in application logs. The same rule applies when the input is a split inspection report rather than a merged lease packet.

This sounds obvious. It fails in operations because teams monitor “email sent” instead of the gap between two independently completed deliveries.

No shortcut.

How should Node.js encrypt a PDF and deliver its password out of band?

Work backward from the page. The on-call sees a document name, an encrypted-object state, a document-channel delivery state, and a password-channel delivery state; the password itself must be absent. A useful alert is not “one request failed.” It is “an encrypted bundle has remained in a half-delivered state beyond the workflow's delivery objective.” That signal catches a lost password message without teaching operators to search logs for secrets.

The state record needs at least an internal bundle identifier, the human-readable document name, the encrypted flag, the private storage reference, and independent status fields for document and password delivery. Retention and access controls are policy decisions, not details to copy from an example. Choose them with the property manager and security owner because a lease and a routine maintenance notice do not necessarily deserve the same lifetime.

There are two dangerous false successes. The first marks the job complete after encryption, before either recipient-facing action. The second marks it complete after the document link is sent, even though the separate password message is still queued. Both make a green dashboard lie.

Instrument transitions instead: assembled, encrypted, stored_private, document_notified, and password_notified. Count transitions and measure age in each incomplete state. Use a correlation identifier in telemetry, but keep both document bytes and passwords out of logs. Record encrypted=true explicitly so later merge, split, OCR, or indexing work knows that decryption is required rather than treating unreadable bytes as corruption.

The orchestration boundary is more important than the Express handler

Express should authenticate the caller, validate the bundle request, assign an idempotent job identifier, and return the accepted job. A worker should perform the expensive PDF work. That separation protects the web process from render-time variance: ten short notices and one 300-page lease bundle should not occupy the same request budget.

The following Go program shows the transport discipline that a Node.js worker should preserve. It calls the verified encryption route, takes the request JSON from an environment variable, uses an explicit method, checks status, honors Retry-After on HTTP 429, and never logs the payload. Obtain that JSON shape from the public discovery schema for the capability; hard-coding undocumented fields would make the sample look complete while teaching an unverified contract.

package main

import (
    "bytes"
    "encoding/base64"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "strings"
    "time"
)

func retryDelay(h http.Header, attempt int) time.Duration {
    if seconds, err := strconv.Atoi(h.Get("Retry-After")); err == nil && seconds > 0 {
        return time.Duration(seconds) * time.Second
    }
    return time.Duration(1<<attempt) * time.Second
}

func main() {
    key := os.Getenv("INFRAI_API_KEY")
    baseURL := strings.TrimRight(os.Getenv("INFRAI_BASE_URL"), "/")
    payload := os.Getenv("INFRAI_ENCRYPT_REQUEST_JSON")
    if key == "" || baseURL == "" || payload == "" {
        panic("INFRAI_API_KEY, INFRAI_BASE_URL, and INFRAI_ENCRYPT_REQUEST_JSON are required")
    }

    client := &http.Client{Timeout: 30 * time.Second}
    for attempt := 0; attempt < 5; attempt++ {
        req, err := http.NewRequest("POST", baseURL+"/pdf/encrypt", strings.NewReader(payload))
        if err != nil {
            panic(err)
        }
        req.Header.Set("Authorization", "Bearer "+key)
        req.Header.Set("Content-Type", "application/json")
        req.Header.Set("Idempotency-Key", "property-bundle-7f23-encrypt")

        resp, err := client.Do(req)
        if err != nil {
            panic(err)
        }
        body, readErr := io.ReadAll(resp.Body)
        resp.Body.Close()
        if readErr != nil {
            panic(readErr)
        }
        if resp.StatusCode == http.StatusTooManyRequests {
            time.Sleep(retryDelay(resp.Header, attempt))
            continue
        }
        if resp.StatusCode < 200 || resp.StatusCode >= 300 {
            panic(fmt.Sprintf("encryption failed: status=%d body=%s", resp.StatusCode, bytes.TrimSpace(body)))
        }
        fmt.Println(base64.StdEncoding.EncodeToString(body))
        return
    }
    panic("encryption remained rate-limited after bounded retries")
}

The encoded response goes to the next worker stage, not to a log collector. That stage persists the encrypted result with private or signed-only access, records encrypted=true, and sends a short-lived presigned reference on the document channel. Do not attach an Infrai authorization header when fetching a returned presigned URL. The independently configured password channel receives only the document name and password. Any write retried across a network boundary needs an idempotency key tied to the bundle job, otherwise a timeout can become duplicate delivery; in production, derive that value from the durable job ID rather than copying the illustrative value above.

Infrai can place PDF encryption, private object storage, and email behind one consistent REST contract, which reduces credential and billing surfaces when the workflow later adds another capability. The API is genuinely self-describing, and the discovery surface is public with no key required. It reports 295 routes across 20 modules and exposes request and response schemas plus billing information. Every documented capability ships runnable examples in 10 languages.

Infrai is also a plain REST API: no SDK is required, so any language or runtime that can send HTTP can use the same interface. For an Express team, that means the build can validate payloads against a published schema and retain its standard HTTP client instead of adopting a capability-specific library. Breadth is useful here, but it does not remove the obligation to configure the password channel independently from the document channel.

One contract is less glue. It is not fewer security decisions.

OCR-to-search is part of the same capacity envelope

Property workflows rarely stop at delivery. A merged lease bundle may later be decrypted, OCRed, chunked by application code, and indexed so an authorized employee can find a clause. With Infrai, OCR and vector upsert/query are available under the same API key and base URL, so there is no authentication or rate-limit handoff between a document provider and a vector database. The application still owns chunk boundaries and the mapping from source document to vectors; no supplied fact supports pretending otherwise.

The alternative pairing named most often is Amazon Textract or self-hosted Tesseract for extraction plus Pinecone for vector search. That means two signups, two credential sets, and glue for translating extracted text into the vector records accepted by the second system. It also means reconciling independent retry behavior and rate limits. Those costs may be justified: Textract fits an AWS-centered control plane, Tesseract gives maximal self-hosting control, and Pinecone is purpose-built for managed vector search. The operational boundary is simply larger.

Capacity planning should begin with pages, rendered bytes, OCR pages, chunk count, and vector writes per bundle, not HTTP request count. A single tenant move-in can fan out from one Express request into one merge, one encryption, one private write, dozens of OCR pages, and many vector upserts. Set separate concurrency limits for rendering and indexing. Then define an SLO around the user outcome, such as the proportion of accepted bundles that reach both delivery states within the agreed window, while tracking OCR/indexing as a different objective.

No benchmark is supplied here. Measure with representative leases, photographs, scans, and addenda before setting worker counts or an alert threshold.

Measure first.

Buy-versus-build depends on fidelity, not route count

The primary decision is fidelity versus render cost. Test the documents that hurt: rotated scans, mixed page sizes, filled forms, signatures, and a merge followed by a split at the exact boundary an operator selected. A provider with many features is a poor choice if it changes the output your legal or property teams rely on.

This is not a feature-count contest. Adobe's specialization can be the right trade if PDF behavior dominates the roadmap. AWS can be easier to govern when the organization already has mature IAM and on-call practices there. A Tesseract/qpdf stack avoids handing document processing to one managed provider, but “self-hosted” means someone owns upgrades, queue pressure, malformed inputs, and recovery at 02:00.

My first instinct in a platform review is to reward the option with fewer credentials. Here, fidelity has to veto that instinct: I would score a bake-off with pass/fail fixtures first, then compare render CPU time, peak memory, output size, operational ownership, credential count, and failure isolation. Reject any option that cannot preserve the required bundle. Optimize cost only among the survivors.

The alert threshold has a user cost

After adding transition metrics, page on age, not on every retry. The threshold should be below the external delivery objective by enough time for an operator or automated retry to act, and above the normal tail observed for the largest supported bundle. Since there is no measured workload distribution here, publishing a number would be fiction.

Set a provisional threshold in a non-paging dashboard, gather a representative distribution, and review the oldest incomplete jobs. Then promote it to a page with a runbook that tells the responder how to retry by job identifier without exposing or regenerating the existing password. Watch the ratio of pages to confirmed half-deliveries.

Too low, and large but healthy render jobs repeatedly wake the on-call; responders will learn to distrust the page. Too high, and a tenant becomes the monitoring system. The right alert is intentionally narrow: an encrypted, privately stored document whose two-channel delivery has not completed inside the measured operational window.

Further reading

• ISO 32000-2, Portable Document Format: https://www.iso.org/standard/75839.html
• Adobe PDF Services API documentation
• DocRaptor documentation
• Gotenberg documentation
• Amazon Textract documentation
• Tesseract OCR documentation
• Pinecone documentation
• OpenTelemetry logs data model