Authentication. MySign Developer Centre

Overview

How authentication works.

MySign uses bearer token authentication. Each API request must include an API token in the Authorization header.

Tokens are organisation-scoped, meaning all resources created via the API belong to your organisation. This provides complete data isolation between different organisations.

Key features

Organisation-scoped access tokens
Secure bearer token authentication
Revocable tokens
No token expiration

Setup

Getting your API token.

Step-by-step guide

Log into your MySign account at mysign.co.uk

Navigate to settings

Go to Settings → API Tokens from your dashboard

Create a new token

Click "Create New Token" and give it a descriptive name (e.g., "Production API", "Development")

Copy the token immediately

Copy and store the token securely. It won't be shown again.

Shown once. Only once.

Important security notice.

Your API token will only be displayed once when created. Make sure to copy it and store it securely. If you lose it, you'll need to create a new token.

Best practices

Store tokens in environment variables, never in code
Use different tokens for production and development
Revoke unused tokens immediately
Rotate tokens regularly for enhanced security

Usage

Using your token.

Include your API token in the Authorization header of every API request using the Bearer scheme.

cURL

curl -X POST https://api.mysign.co.uk/api/v1/native/envelopes/create \
  -H "Authorization: Bearer YOUR_API_TOKEN_HERE" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"template_id": "01ABCD..."}'

PHP (using Guzzle)

PHP

$client = new GuzzleHttp\Client();

$response = $client->post('https://api.mysign.co.uk/api/v1/native/envelopes/create', [
    'headers' => [
        'Authorization' => 'Bearer ' . $apiToken,
        'Content-Type' => 'application/json',
        'Accept' => 'application/json',
    ],
    'json' => [
        'template_id' => '01ABCD...'
    ]
]);

JavaScript (using fetch)

JavaScript

const response = await fetch('https://api.mysign.co.uk/api/v1/native/envelopes/create', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiToken}`,
    'Content-Type': 'application/json',
    'Accept': 'application/json'
  },
  body: JSON.stringify({
    template_id: '01ABCD...'
  })
});

const data = await response.json();

When it goes wrong

Authentication errors.

401

Unauthorized

Returned when the token is missing, invalid, or revoked.

{
  "message": "Unauthenticated."
}

403

Forbidden

Returned when attempting to access resources outside your organisation.

{
  "message": "Forbidden."
}

Authentication.