Authentication

Every request must carry an API token in the x-api-token header.

Create and revoke tokens at Settings → Profile → API Tokens:
app.signater.com/settings/profile/api-tokens

You can create as many tokens as you like and revoke any of them immediately, so it is worth giving each integrated system its own. Rate limits are counted per token, so separate tokens also mean separate budgets.

A token is bound to one user, one account and one environment. There is no header for acting on behalf of another user or a managed account.

Token format

A token is 32 lowercase hexadecimal characters. A value of any other length is rejected before it is ever looked up, so a token pasted with a stray space or newline fails exactly like one that does not exist. If you get an unexplained 401, check the length first.

Requirements

The API is available on the Business plan or above — Business and Enterprise in the plan list. This covers webhooks and the SMS and WhatsApp channels too.

A token from a lower plan authenticates correctly but is refused:

{ "message": "API access requires a Business plan or higher." }

Plans are managed at app.signater.com/settings/billing/plans by an account administrator.

401 or 403

401 means Signater could not identify anyone. That covers a missing header, a malformed token, one that was revoked, and — worth knowing — one belonging to a deactivated user or a deactivated membership, because those are filtered out of the lookup rather than reported separately.

{ "message": "User should be authenticated." }

403 means you were identified and refused. Four conditions produce it from the front door: the account is inactive, the plan does not include the API, sandbox is switched off, or the endpoint requires an administrator. Three more come from account settings, when a request asks for Pix or WhatsApp on an account where they are disabled. Error handling lists all seven with their exact messages.

Sandbox

Sandbox is a parallel environment with its own vaults, envelopes, templates and contacts. You create a sandbox token in the app and the API serves sandbox data for it — no separate host, no extra header.

Sandbox requires the Business plan, the same as production. If it has been switched off for your account, requests return 403 with Sandbox mode is disabled.; an account administrator can turn it back on in Account settings.

Read the Sandbox page before testing. Two behaviours surprise people: signer invitations are really sent, and publishing consumes a real envelope from your balance.

Rate limiting

1,000 requests per 10-minute sliding window, per token.

The window moves in one-minute segments rather than resetting on the hour, so capacity is released continuously. Sustained traffic of about 100 requests a minute stays inside the limit indefinitely.

Past the limit, the next hundred requests are queued rather than refused — they complete, but slowly, waiting for capacity. Beyond that the API returns 429 with a Retry-After header. If your calls suddenly take seconds instead of milliseconds, you are in the queue.

Calling from a browser

Don't. The API accepts any origin, which means a token shipped to a browser is readable by anything running there. Tokens belong on your server.

Token format#

Requirements#

401 or 403#

Sandbox#