Create and manage API keys
Mint a test or live API key under Settings > Developer, copy the secret the one time it is shown, and rotate or revoke keys without downtime.
Open Settings > Developer > API keys and click New API key. Give it a name, choose Test or Live, and copy the secret from the dialog that follows, because that is the only time it is ever shown. The Developer section is available on Business and Ultimate, and it's admin-only.
Test keys and live keys
The two modes are completely separate. A live key cannot see a sandbox document, and a test key cannot see a real one. The panel at the top of the tab spells out the difference and stays on screen permanently.
| Test | Live | |
|---|---|---|
| Prefix | sk_test_ | sk_live_ |
| No email is ever sent, to anyone | Emails real signers the moment you send | |
| Result | Signed PDFs carry a sandbox watermark | Produces a legally binding document |
| Billing | Never counted against your plan, never billed | Counts against your plan allowance |
Build against a test key first. Swap the value in your environment for a live one when the integration is doing what you expect, and nothing else about your code needs to change. Webhook endpoints split the same way, so a test endpoint only ever hears about test documents.
Create an API key
-
Open Settings > Developer > API keys.
-
Click New API key.
-
Type a Name. Use something that says where the key runs, like "Production backend" or "Staging worker", since that name is all you'll have to go on months later.
-
Pick a Mode. The helper line under the field changes to match: sandbox documents are watermarked and send no email, or live documents email real recipients and count towards your plan.
-
Click Create key.
-
The dialog switches to Copy your API key. Click Copy key, paste it into your secret store, then click Done.
That last dialog will not close on Escape or on a click outside it. Dismissing it loses the secret for good.
Read the key list
Six columns: Name, Mode, Key, Last used, Created and Actions. Key is truncated to the prefix plus four characters, which is enough to match a row against the value in your environment without exposing anything. Mode carries a Live or Test badge.
Last used is the column to watch during a rotation. A key that has not been used since you deployed the replacement is safe to revoke. Created is the one that settles arguments about which of two similarly named keys came first.
Rotate a key without downtime
Rotate in this order and nothing breaks:
- Create a second key in the same mode and give it a name that identifies the new deployment.
- Deploy the new value to your servers.
- Wait until Last used on the old row stops advancing.
- Revoke the old key.
If a key has leaked, skip the waiting. Revoke it now and accept the short outage while you deploy a fresh one.
Revoke a key
Click Revoke on the row. The dialog puts the key name in its heading, so a key called "Production backend" gives you Revoke Production backend?, and the confirm button reads Revoke key. Anything using that key stops working immediately, and the change cannot be undone. The row stays in the list, dimmed, with the word Revoked where the button was, so your history stays readable.
Use the key with an Authorization: Bearer header, and see API usage and rate limits for the base URL and what a live document counts towards.
If something goes wrong
- A request comes back unauthorized. Either the key was revoked, or a stray space or newline crept in when it was pasted into your configuration.
- The row shows Expired. The key was created with an expiry date and that date has passed. Nothing will authorize with it again. Create a replacement and deploy the new value.
- You cannot create another key. You're at ten active keys. Revoke one that is no longer used and try again.
- The Developer entry is missing from Settings. You're not a workspace admin. Ask an admin to mint the key and pass it to you through your secret store.
- A test integration is emailing real people. You're holding a live key. Check the prefix on the value your code actually loaded.
- The Developer section shows an upgrade panel. The workspace is below Business. The panel names the plan and has an Upgrade workspace button.
Frequently asked questions
I closed the dialog without copying the key. Can I see it again?
No. Only a hash of the secret is stored, and nothing in the product can print the original. Revoke that key, create a replacement, and copy it this time. The dialog deliberately ignores the Escape key and clicks outside it for exactly this reason.
What can someone do with a live key?
Everything you can do, because the key acts as the person who created it and carries their role. It sends real documents from your workspace to real email addresses. Treat it like a password and store it in your server's secret manager, never in front-end code or a repository.
How many keys can one workspace hold?
Ten active keys, counting test and live together. Revoked keys do not count towards it, so cleaning up old ones frees room. Try to create an eleventh and the request is refused with a message telling you to revoke one first.
Does a test key cost anything or email anyone?
Neither. A key beginning sk_test_ creates sandbox documents that send no email to anyone, produce a watermarked PDF, and are never counted against your plan or billed. A live key does all three of those things for real, and every live document it creates counts towards the API document allowance on your plan.
Can a manager or member create a key?
No. Key creation, revocation and the whole Developer section are restricted to workspace admins. A key bypasses the normal sign-in entirely and inherits its creator's role, so handing that ability to every member would quietly widen what they can do.
Keep going
Set up webhooks and replay deliveriesBusiness and up
Register an https endpoint, subscribe it to document events, verify the signature header, and replay any delivery from the log without touching your data.
ReadAPI usage and rate limitsBusiness and up
See how many API documents this billing cycle has used, what happens past the included allowance, and the per-key request limit your plan carries.
ReadEmbedded signing and allowed originsBusiness and up
Add the https origins allowed to frame your signing pages, then mint a short-lived embed link for one recipient and load it in an iframe.
Read