Authentication
Authenticate REST API requests with a bearer API key.
The REST API authenticates with an API key sent as a bearer token:
curl https://app.signadoc.com.au/api/v1/documents \
-H "Authorization: Bearer esk_live_xxx"API keys
- Create and revoke keys in the web app under your organisation's Settings → API tokens (organisation owners and admins only).
- Keys are formatted
esk_<env>_<random>—esk_live_…in production,esk_test_…elsewhere. - Only a SHA-256 hash is stored; the full key is shown once at creation. Store it securely.
- Every key belongs to one organisation and acts within that organisation's workspace: documents it creates are owned by the organisation, and webhooks it registers receive that organisation's events.
- Keys can be given an expiry and revoked at any time. Requests with a missing, invalid, expired, or
revoked key return
401.
Idempotency
POST creation requests accept an Idempotency-Key header. Re-sending the same key returns the
original response (cached for 24 hours) instead of creating a duplicate, so writes are safe to
retry. Replayed responses carry an Idempotent-Replayed: true header.