API Reference
Getting started · Authentication
Getting started
Authentication
Every documented request is authenticated with a bearer token. One endpoint additionally uses an API key header.
Bearer token
All documented requests include your API token in the Authorization header:
HTTP
Authorization: Bearer <BEARER_TOKEN>
Keep credentials server-side
Store credentials securely on the server and never expose them in:
- Browser JavaScript
- Public HTML
- Source repositories
- Screenshots
- Mobile source code
Use environment variables or a secrets manager:
Shell
UNDERSIGN_API_TOKEN=your-secret-token UNDERSIGN_API_KEY=your-api-key