Authentication

The API authenticates every request with a bearer token. Your token also determines the organization (tenant) it acts on — you never pass a tenant id yourself.

Bearer tokens

Send your token in the Authorization header on every request:

Authorization header

Authorization: Bearer qsign_live_a1b2c3...

A complete request looks like this:

cURL

curl 'https://api.sign.quathos.com/api/v1/envelopes' \
  -H 'Authorization: Bearer $QUATHOS_SIGN_TOKEN'

Keep secrets server-side

A token grants access to your organization's data. Use it only from your backend, never from browser or mobile clients. If a token leaks, revoke it immediately from the dashboard.

Live & test environments

Every token carries its environment, encoded in the token prefix — qsign_live_… or qsign_test_…. There is a single base URL; the token alone selects the environment.

Test — isolated data. No real emails are sent to signers and no paid credits are consumed. Ideal while you integrate.
Live — production. Emails are delivered and credits are consumed as usual.

The environment is fixed when the token is created and cannot be changed afterwards.

Creating a token

Tokens are created from the dashboard, under Settings → API tokens. Choose the environment and the scopes it needs, then copy the secret.

Shown once

The full token secret is displayed only once, at creation. We store just a hash — if you lose it, create a new token and revoke the old one.

Scopes

A token only reaches what its scopes allow. Grant the least you need — a token that just sends envelopes doesn't need documents:write. Missing a scope returns 403 missing_scope.

Scope	Type	Description
`documents:read`	scope	List and download documents.
`documents:write`	scope	Upload documents.
`envelopes:read`	scope	Read envelopes, evidence and dossiers.
`envelopes:write`	scope	Create envelopes, add participants and fields.
`envelopes:send`	scope	Send envelopes and remind participants.
`envelopes:cancel`	scope	Cancel an envelope in progress.
`templates:read`	scope	List and read templates.
`templates:write`	scope	Create, update and apply templates — including bulk send.
`labels:read`	scope	List labels.
`labels:write`	scope	Create and edit labels.
`signatures:read`	scope	Read signature records.
`signatures:validate`	scope	Validate signatures and document hashes.
`audit:read`	scope	Read the audit trail.
`webhooks:manage`	scope	Manage webhook endpoints and deliveries.
`integrations:manage`	scope	Manage cloud storage connectors (Google Drive / OneDrive).
`billing:read`	scope	Read credit balance, usage and plan (read-only).

Idempotency

All write requests accept an Idempotency-Key header — a unique value (a UUID works well) per logical operation. Retrying with the same key and the same payload returns the original result instead of creating a duplicate. Reusing a key with a different payload returns 409 conflict.

Idempotency-Key header

Idempotency-Key: 5c1f8b2e-9d4a-4f7c-8b1e-2a6f0c3d5e7a

Base URL

All endpoints live under a single versioned prefix:

Base URL

https://api.sign.quathos.com/api/v1

Previous Quickstart Next Errors