OAuth2 clients and API keys
When to use a static key, when to use OAuth, and how to set up a client.
There are two ways to authenticate, for two different situations.
API keys — your own integration
A static secret (sk_live_… or sk_test_…) that acts as one specific user. Right when you're wiring SignSpry into your own systems. Create one under API.
OAuth2 — an app other people use
When you're building something that other SignSpry accounts install, you need each customer to grant access to their own account. Register an OAuth client under API → OAuth clients and you get a client_id and client_secret.
Client credentials
For server-to-server access to your own account:
curl -X POST https://www.signspry.com/oauth/token \
-d grant_type=client_credentials \
-d client_id=cid_... \
-d client_secret=...Returns an access token valid for one hour. Use it exactly like an API key.
Authorization code
For acting on another account's behalf. Send the user to:
/oauth/authorize?client_id=cid_...&redirect_uri=...&response_type=code&scope=envelopes:writeThey approve, you receive a code on your redirect URI, and you exchange it:
curl -X POST https://www.signspry.com/oauth/token \
-d grant_type=authorization_code \
-d code=... -d client_id=cid_... -d client_secret=... \
-d redirect_uri=...PKCE is supported — send code_challenge on the authorize call and code_verifier on the exchange.
Scopes
| Scope | Grants |
|---|---|
envelopes:read | List and read envelopes |
envelopes:write | Create, send, correct and void |
templates:read | Read templates |
account:read | Read account details |