Skip to content

Authentication

Machine authentication and token introspection.

v1 · 2026-01-15

POST/auth/machine-token

Exchange API key credentials for machine access token

Returns a short-lived bearer token carrying the API key's scopes. **Scopes.** A key holds a subset of exactly these six: | Scope | Grants | |---|---| | `contracts:read` | Read contracts, participants, status and documents. | | `contracts:create` | Create draft contracts from templates. | | `contracts:send` | Dispatch contracts for signing, issue hosted signer links, drive client signing sessions. Issues credentials on behalf of signers. | | `templates:read` | List templates; read published versions and input schemas. | | `webhooks:read` | Read webhook endpoints and delivery history. | | `webhooks:manage` | Create, update, rotate and delete webhook endpoints. | There is no `*` wildcard. It was previously honoured as "every scope, including ones added later" and is now refused at key creation (`400 API_KEY_SCOPE_WILDCARD_FORBIDDEN`) and matches nothing at enforcement. Any scope outside the table is refused with `400 API_KEY_SCOPE_UNKNOWN`. Scope enforcement is always on. It was previously active only when `NODE_ENV` was exactly `production` or `test`, so in every other environment a scoped key and an unscoped key behaved identically.

Request body

  • apiKeyIdstring
  • apiKeySecretstring

Responses

  • 200Machine token issued
  • defaultStandardized API error
GET/auth/machine-token/meRequires authentication

Validate machine token and return claims

Responses

  • 200Machine token claims
  • defaultStandardized API error
GET/meRequires authentication

Get current machine token context

Responses

  • 200Token context
  • defaultStandardized API error