Skip to content
Last updated

Authentication

All plans except Pay As You Go include API access.

The Signable API uses Basic HTTP Authentication. You authenticate requests using your API key as the username. The password field accepts any value and is not validated.

To authenticate a request, include an Authorization header with your Base64-encoded credentials:

Authorization: Basic <base64(API_KEY:x)>

Where:

  • API_KEY is your Signable API key
  • x is a placeholder password

Create an API key

  1. Log into the Signable web app.

  2. Navigate to Company Settings → API & Webhooks.

  3. Click Add API Key.

  4. Enter a name for your key.

  5. Click Save.

    API key creation interface

  6. Click Show key to view your API key.

    Show API key button

Copy and store your API key securely. The key is displayed only once.

Generate a test API key

Test API keys allow you to test integrations without affecting production data.

To create a test API key, toggle the Production key switch off in step 5 above. For more information, see Testing API calls.

Security requirements

Warning: You must use HTTPS for all API calls. Signable rejects HTTP requests.

Signable supports TLS 1.2 and higher.

Protect your API keys

Do not add API keys directly to your code files. If you commit code containing API keys to version control platforms such as Git, GitHub, or similar platforms, others can see and steal your keys.

Instead, store API keys securely in:

  • Environment variables
  • Secret management services (such as AWS Secrets Manager or HashiCorp Vault)
  • Configuration files that are excluded from version control (add them to .gitignore)

For added security, ensure you:

  • Use environment variables or secret management systems.
  • Rotate API keys regularly.
  • Use test keys for development and production keys for live environments.

If an API key is compromised, revoke it immediately in Company Settings → API & Webhooks.

Previous page
Next page