Skip to main content

PDF Security

The PDFs for 1099, W-2, or W-9/W-8, and other forms contain Personally Identifiable Information (PII) of recipients and employees. To ensure the highest level of security for this sensitive data, TaxBandits has implemented additional security measures for form PDFs.

For 1099/W-2 Forms:​

  • The PDF links provided in the response of RequestDraftPdfUrl and RequestPDFURLs methods are encrypted by default. You can decrypt these links before downloading the files.

For W-9/W-8 Forms:​

  • By default, the PDF URLs provided in the API responses of the Get or List methods are not encrypted. However, for enhanced security, especially since W-9/W-8 forms contain Personally Identifiable Information (PII), you can enable encryption in your console under Credentials → W-9/W-8 PDF Security Preferences. If encryption is enabled, you will need to decrypt the links before downloading the files.
  • Additionally, if you prefer not to include PDF URLs in the response, you can disable this feature.

Decrypt the PDF URLs​​

To decrypt the URL, you will need the following parameters.

  1. AWS AccessKey
  2. AWS SecretKey
  3. Base64Key
  4. S3 Bucket Name

All the above values will be available on your TaxBandits console site. Log in to the console site and navigate to Settings >> Credentials

API Credentials

  1. S3 file path - This is the file path you received in the RequestPdfUrls endpoint Response.

    Sample PDF Path you will get in the Response -> https://expressirsforms.s3.us-east-1.amazonaws.com/pdfs/ac5df30c-6b81-49ab-b85e-8122128d227f/6c36e3fa-5d6f-4c21-81df-2e1e0c27305c/1099/36253545/m/copy1_1up_36253545.pdf

    How to Decrypt the URL?
    • In Sandbox, insert the complete PDFUrl or PDFPath into the code under the S3 file path.
    • In Live, insert only the PDFPath instead of the complete Url.

Sample Code:​

Send the above-listed parameters using a code to decrypt the PDF URL for download. Here is a sample code for NodeJs.

{
    const AWS = require("aws-sdk");//  reference library
    AWS.config.update({region:"us-east-1"}); // don't change this US-East-01
    const s3 = new AWS.S3({
    accessKeyId: "<<AWS AccessKey>>",
    secretAccessKey: "<<AWS SecretKey>>"
    });
    const ssecKey = Buffer.alloc(32, "<<Base64Key>>",'base64') // you can get the key from Taxbandits API Console
    var params = {
        Key: "<<S3 file path>>",// File path without main domain URL.
        Bucket: "<<Bucket Name>>",// Get the Bucket Name from the URL given in the response
        SSECustomerAlgorithm: "AES256",
        SSECustomerKey: ssecKey
        }
    var file = require('fs').createWriteStream('<<samplepdfname.pdf>>');// save the pdf in local
    s3.getObject(params).createReadStream().pipe(file);
}