Docs
Dashboard Get an API key

Get started

Authentication

Create API keys on the dashboard and send one with every request. The same key works for the REST API and the MCP server.

Every request to the API and the MCP server carries an API key. A key acts as the account that made it: it can read and change everything the account owns, under the same rules as the dashboard.

Create a key

  1. Log in and open the API page on the dashboard.
  2. Give the key a name that says where it will be used, such as billing-server or claude-desktop, and create it.
  3. Copy the secret. It is shown once: Sigil only stores a hash of it, so it cannot be shown again. If you lose it, create another key.

An account can have any number of keys. Use a separate key for each place it is used, so you can revoke one without touching the others. The API page shows when each key was last used.

A key looks like sgk_ followed by 40 letters and digits, and it is case-sensitive:

Text
sgk_4fXq9TmB2kLr7NcVw0YhZs8EaDj3GuPo6RiK1tHb

Send it

Put the key in the Authorization header as a bearer token, or in an X-Api-Key header. Both work everywhere:

curl https://api.signwithsigil.com/v1/me \
  -H "Authorization: Bearer $SIGIL_API_KEY"

The MCP server takes the same key, in the same headers.

Plans

Any account can create keys, but using them needs the Pro or Business plan. On other plans every call answers 403. Upgrading on the Billing page takes effect straight away, with the same keys.

Revoke a key

Revoke a key on the API page. It stops working immediately, for the API and the MCP server. Revoke any key that may have been exposed, and create a new one.

Keep keys secret

A key is the whole account: it can send pacts, which uses documents you pay for, and read every document you have sent.

  • Keep it on a server, in an environment variable or a secret manager. Never put it in a web page, a mobile app or a repository.
  • The API answers cross-origin requests, so a key placed in browser code would work for anyone who opened the page. Call the API from your backend instead.
  • Give each integration its own key, and revoke the ones you no longer use.

When it fails

A missing, mistyped or revoked key answers 401. A valid key on a plan without API access answers 403. Both bodies say why:

{ "error": "Missing, unknown or revoked API key." }