SignRequest Authentication: API Keys & Security (2026)

Authentication overview

SignRequest's API provides programmatic access to its e-signature platform, allowing developers to integrate document signing workflows directly into their applications. Authentication for the SignRequest API is managed through API keys, which serve as bearer tokens to verify the identity and authorization of the calling application. This method ensures that only authorized entities can create, send, and manage documents, signers, and templates via the API.

The API follows a RESTful design, meaning interactions are stateless and resources are accessed via standard HTTP methods (GET, POST, PUT, DELETE) over HTTPS. Each request to a protected endpoint must include a valid API key in the Authorization header. This approach aligns with common practices for securing web APIs, offering a balance of simplicity for developers and robust security for sensitive document operations. The SignRequest API documentation provides comprehensive details on endpoint structures and expected request/response formats for all available operations, including document management and webhook configurations.

Supported authentication methods

SignRequest primarily supports API key authentication for its API. This method involves generating a unique key from your SignRequest account, which is then used as a bearer token in API requests. This is a common and effective method for server-to-server communication or when integrating services where a user's direct login isn't required for every API call.

While API keys are the primary method for API access, SignRequest's web application also supports traditional username/password authentication for user logins. For managing API keys and other account settings, users interact with the web interface. The API itself is designed for machine-to-machine communication rather than direct user authentication.

The table below summarizes the authentication method supported by the SignRequest API:

Other authentication standards like OAuth 2.0, while widely adopted for user delegation, are not directly supported for API access in SignRequest's current API specification. However, applications can implement OAuth 2.0 for their own user authentication and then use a stored SignRequest API key to interact with the SignRequest API on behalf of their users. For more information on OAuth 2.0 flows, the OAuth 2.0 specification outlines various grant types for different application scenarios.

Getting your credentials

To obtain your SignRequest API key, you must have an active SignRequest account. The process involves navigating to your account settings within the SignRequest web application:

1. Log in to your SignRequest account: Access the SignRequest platform using your registered email and password.
2. Navigate to API settings: Once logged in, go to the 'API' or 'Integrations' section within your account settings. The exact path may vary slightly but typically involves clicking on your profile icon or account name to reveal a dropdown menu, then selecting 'API' or 'Developer settings'.
3. Generate a new API key: Within the API settings, you will find an option to 'Generate API key' or 'Create new key'. Clicking this will generate a unique alphanumeric string.
4. Copy and store your API key securely: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it in a secure location, such as an environment variable, a secrets manager, or a secure configuration file. SignRequest typically only displays the full key once, and you may not be able to retrieve it again if lost. If lost, you will need to generate a new key and revoke the old one.

Each API key is associated with your account and grants access to the resources and permissions available to that account. It is recommended to generate separate API keys for different applications or environments (e.g., development, staging, production) to enhance security and simplify key revocation if compromise occurs. For detailed, step-by-step instructions, refer to the SignRequest API authentication guide.

Authenticated request example

Once you have obtained your API key, you can use it to authenticate your requests to the SignRequest API. The API key must be included in the Authorization header of your HTTP requests, prefixed with Bearer. This is a standard practice for token-based authentication.

Below is an example of an authenticated API request using curl to list documents. Replace YOUR_SIGNREQUEST_API_KEY with your actual API key.

curl -X GET \
  'https://signrequest.com/api/v1/documents/' \
  -H 'Authorization: Bearer YOUR_SIGNREQUEST_API_KEY' \
  -H 'Content-Type: application/json'

This example demonstrates a GET request to the /documents/ endpoint, which retrieves a list of documents associated with your SignRequest account. The Authorization header carries the API key, allowing the SignRequest server to verify the request's authenticity.

For programmatic access in various programming languages, the approach remains consistent:

• Python: Use the requests library to set the Authorization header.
• Node.js: Use axios or the built-in https module to include the header.
• PHP: Use curl functions or a Guzzle HTTP client to add the header.

Always ensure your API key is not hardcoded directly into your application's source code, especially for client-side applications or publicly accessible repositories. Instead, load it from environment variables or a secure configuration management system.

Security best practices

Securing your SignRequest API keys and ensuring the integrity of your e-signature workflows is paramount. Adhering to these best practices can significantly mitigate security risks:

1. Treat API Keys as Sensitive Credentials: Your API key grants full access to your SignRequest account's API capabilities. Treat it with the same level of security as you would a password. Never hardcode API keys directly into client-side code, public repositories, or commit them to version control systems like Git without proper encryption and access control.
2. Use Environment Variables or Secret Management: Store API keys in environment variables (e.g., SIGNREQUEST_API_KEY) or a dedicated secret management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). This prevents keys from being exposed in source code and allows for easier rotation and management across different environments. Google Cloud Secret Manager provides a secure and scalable way to store and manage API keys.
3. Restrict API Key Permissions (if available): While SignRequest API keys typically grant broad access, if the platform introduces granular permissions for keys in the future, adhere to the principle of least privilege. Grant only the necessary permissions for the tasks your application needs to perform.
4. Regular Key Rotation: Periodically rotate your API keys. This practice limits the window of exposure if a key is compromised. The frequency of rotation depends on your organization's security policies and risk assessment. When rotating, generate a new key, update your applications, and then revoke the old key.
5. Monitor API Key Usage: Keep an eye on your API key usage patterns. Unusual spikes in requests, requests from unexpected IP addresses, or attempts to access unauthorized resources could indicate a compromised key. SignRequest's dashboard or audit logs may provide insights into API activity.
6. Implement HTTPS Everywhere: Always ensure that all communication with the SignRequest API occurs over HTTPS. This encrypts data in transit, protecting your API key and sensitive document information from interception. SignRequest enforces HTTPS for all API endpoints. The Mozilla Developer Network's guide on HTTPS provides details on its importance.
7. Secure Your Development Environment: Ensure that your development machines and build servers are secure and protected against malware and unauthorized access. Compromised development environments can lead to the exposure of API keys and other sensitive credentials.
8. Webhook Security: If utilizing SignRequest webhooks, verify the authenticity of incoming webhook requests. SignRequest includes a signature in the request headers that you can use to confirm the webhook originated from SignRequest, protecting against spoofed requests.
9. Error Handling and Logging: Implement robust error handling in your application to gracefully manage API errors. Log API call failures and authentication errors securely to detect potential issues or attack attempts.