Authentication
Create a workspace API key and authenticate requests with it.
Every API request is authenticated with a workspace API key — a secret that belongs to your workspace, created and revoked from the app.
Create a key
- In the web app, open Settings → Developer → API keys.
- Choose Create key, give it a name that says where it will be used ("Salesforce integration", "Intake bot"), and optionally an expiry date.
- Copy the key immediately. It starts with
isk_live_and is shown only once — instaSpace stores a hash, not the key itself. If you lose it, revoke it and create a new one.
Treat the key like a password: keep it in your secret manager, never in source control or client-side code. Anyone holding the key can send signature requests and download signed contracts from your workspace.
Use the key
Send it as a Bearer token on every request:
curl https://api.instaspace.ai/api/v1/esign/templates \
-H "Authorization: Bearer isk_live_..."How access is checked
A key is tied to the workspace and to the member who created it. On every request, instaSpace re-checks that:
- the key has not been revoked and has not expired,
- its creator is still a member of the workspace, and
- the workspace's plan still includes e-signatures.
So access ends the moment a key is revoked, its creator leaves the workspace, or the plan is downgraded — not at some later rotation. Signature requests created through the API are attributed to the key's creator, and API activity (like downloading a signed document) appears in the workspace audit log with the key's identity.