API keys

Create and scope keys for machine-to-machine access to your workspace.

API keys give scripts and integrations machine-to-machine access to your workspace. Available on Solo and Studio.

Creating a key

In Settings, open API keys and create one. The full secret is shown once, at creation — copy it somewhere safe. You can revoke a key at any time, which stops it working immediately.

Key format

Keys are prefixed so they're easy to spot in logs and secret scanners:

dctr_live_xxxxxxxxxxxxxxxxxxxxxxxx

A key acts with member-level access and is scoped to the /documents surface only. It can never reach billing, workspace settings, admin, or key management — so a leaked key can't escalate into more keys.

Authenticating

Send the key as a bearer token on every request:

curl
curl https://foliosign.com/api/v1/documents \
  -H "Authorization: Bearer dctr_live_..."
Keep keys server-side

A key carries full document access for your workspace. Never ship one in a browser bundle, a mobile app binary, or a public repo. Rotate immediately if one leaks.

Related