Authentication

The REST API authenticates with an API key sent as a bearer token:

curl https://web.esign.codeless.au/api/v1/documents \
  -H "Authorization: Bearer esk_live_xxx"

Plan requirement

The REST API and webhooks are included from the Business plan up. An organisation on a lower plan can hold keys, but requests with them return 403 forbidden, and the check runs on every request — a key issued on Business stops working if the organisation moves down a plan. See Pricing.

API keys

• Create and revoke keys in the web app under your organisation's Settings → API tokens (organisation owners and admins only).
• Keys are formatted esk_<env>_<random> — esk_live_… in production, esk_test_… elsewhere.
• Only a SHA-256 hash is stored; the full key is shown once at creation. Store it securely.
• Every key belongs to one organisation and acts within that organisation's workspace: documents it creates are owned by the organisation, and webhooks it registers receive that organisation's events.
• Keys can be given an expiry and revoked at any time. Requests with a missing, invalid, expired, or revoked key return 401; a valid key on an organisation whose plan excludes the API returns 403.

Idempotency

POST creation requests accept an Idempotency-Key header. Re-sending the same key returns the original response (cached for 24 hours) instead of creating a duplicate, so writes are safe to retry. Replayed responses carry an Idempotent-Replayed: true header.