Authentication
Authenticate REST API requests with a bearer API key.
The REST API authenticates with an API key sent as a bearer token:
curl https://web.esign.codeless.au/api/v1/documents \
-H "Authorization: Bearer esk_live_xxx"API keys
- Create and revoke keys in the web app under Settings → API tokens (personal) or a team's Settings → API tokens (team-scoped).
- Keys are formatted
esk_<env>_<random>—esk_live_…in production,esk_test_…elsewhere. - Only a SHA-256 hash is stored; the full key is shown once at creation. Store it securely.
- A team-scoped key acts within that team's workspace; a personal key acts on your personal documents.
- Keys can be given an expiry and revoked at any time. Requests with a missing, invalid, expired, or
revoked key return
401.
Idempotency
POST creation requests accept an Idempotency-Key header. Re-sending the same key returns the
original response (cached for 24 hours) instead of creating a duplicate, so writes are safe to
retry. Replayed responses carry an Idempotent-Replayed: true header.