Authentication

APISign uses API keys for authentication. Every endpoint in this reference requires a valid API key in the request headers, except /contract/verify, /health/check, /health/db and /openapi, which are public.

Base URL:https://apisign.io/api

API Key Management

Getting Your API Key

Log in to your APISign dashboard
Navigate to Account → MCP & API Keys
Click Create API Key, give it a name, and choose an expiration and permission
Copy and securely store your API key

Important

API keys are only shown once during creation. Store them securely and never share them publicly.

Keys start with ask_. Each key belongs to one organization, and every request made with it acts on that organization's contracts, templates and webhooks.

Expiration

In the dashboard a key can expire after 7, 30, 90 or 365 days, or never. Through the API (expiresInDays) any number of days is accepted. An expired key returns 401.

Permissions

Permission	Value	Effect
Read/Write	`read_write`	Full access. The default.
Read Only	`read`	Removes the write tools from the MCP server tool list.

REST endpoints do not check permissions

The permission only applies to the MCP server. A Read Only key can call every REST endpoint, including the ones that create, send, cancel and delete.

There are no separate test keys. Test mode is set per contract with test_mode; see Test mode.

Authentication Method

Include your API key in the x-api-key header:

x-api-key: your_api_key_here

When the header is present it is the only credential checked. Without it, the endpoints fall back to the dashboard's session cookie.

Example Requests

cURL Example

curl -X GET https://apisign.io/api/contract/find \
  -H "x-api-key: your_api_key_here"

JavaScript Example

const response = await fetch('https://apisign.io/api/contract/find', {
  method: 'GET',
  headers: {
    'x-api-key': 'your_api_key_here'
  }
});

const { contracts } = await response.json();

Python Example

import requests

headers = {
    'x-api-key': 'your_api_key_here'
}

response = requests.get('https://apisign.io/api/contract/find', headers=headers)
contracts = response.json()['contracts']

Error Responses

Authentication Errors

401 Unauthorized

Returned when the key is missing, unknown, expired, or deleted.

{
  "error": "Unauthorized"
}

Managing Keys via the API

These endpoints manage your organization's keys. They accept an API key or a dashboard session.

Security Best Practices

API Key Security

Never commit API keys to version control
Use environment variables to store keys
Rotate keys regularly: create a new key, deploy it, then delete the old one
Use different keys for different environments
Delete compromised keys immediately
Check lastRequest and requestCount from /apikey/list for unexpected use

Network Security

Always use HTTPS for API requests
Implement proper SSL certificate validation