Guide

Authentication

API keys, what they can do, and how to keep them safe.

API keys

Send your key in the Authorization header on every request. There is no other way to sign in to the API.

http

Authorization: Bearer sk_live_…

A key belongs to one workspace and acts as the person who made it. Documents you send with it show that person as the sender, and the audit trail marks the action as made through the API.

Workspace admins make keys in Settings, Developers, or with POST /api-keys. The full key is shown once; we keep only a fingerprint of it.

Keep keys on your server

Never put a key in a browser, a mobile app or a public repository. The API does not allow browser (CORS) requests.
Use one key per system, so you can revoke one without touching the others.
To replace a key, roll it (POST /api-keys/{id}/roll): the old key stops working at once and a new one with the same name is returned.
Revoked or unknown keys get 401 unauthenticated.

The API address

All API calls go to https://api.esorasign.com/v1. Only requests with an API key reach the API there; anything else gets 401 or 404. The MCP connector is at https://api.esorasign.com/mcp with the same key.