API App credentials and API keys

Use client credentials

Open an app and select Credentials. The Client credentials card shows the client_id and a masked secret. These credentials identify the OAuth application and are used when exchanging an authorization code for an access token. Use the copy controls only when adding them to a secure application configuration.

Continue with OAuth authorization

After the app is registered and the Client ID and Client Secret are secured, continue to the Requesting the Authorization Code step in the Evia Sign API documentation. Evia Sign redirects the user to the registered Redirect URI with the authorization result.

Create and manage API keys

1. Open Credentials - Select Add API Key.

2. Configure the key - Enter a unique key name and select one or more scopes. An API key can use only scopes granted to its app.

3. Create and store the key - Select Create API key, copy the displayed value, and store it before selecting Done. The full key is shown only once.

Header name: X-Api-Key
Value: <your API key>

Existing keys show their status and scopes. Select Rotate to replace a valid key, or Revoke to invalidate it. A revoked key cannot be used or rotated again.

Linked webhooks and activity

Each app detail page includes Webhooks and Activity tabs. Use them to understand how an app is connected and to review its operational history.

Tab	What you can do
Webhooks	Review endpoints linked to the app. Select Add webhook to create another linked endpoint, or Edit to update an existing endpoint.
Activity	Review document-access and linked-webhook activity, including status, event type, related document or request ID when available, and time.

Webhooks

Webhooks let Evia Sign send selected events to an HTTP endpoint. Configure only the event types and security controls your receiving service requires.

Create a webhook

1. Open Webhooks. - Select New Webhook.

2. Enter webhook details. - Provide a display name, one or more events, and a valid absolute callback URL.

3. Choose the relationship. - Optionally select Link to an app. Select Standalone (No app) when the endpoint is not app-specific.

4. Set delivery state and security. - Keep Active webhook enabled to allow matching events to be delivered. Select a security mode and complete its required configuration.

5. Save. - Select Save Webhook. When HMAC or OAuth is used on an active webhook, Evia Sign tests the callback before saving.

Field	Purpose
Display name	A meaningful label, such as Request Completed.
Events	One or more event types to deliver. Available options are provided by Evia Sign.
Callback URL	The receiving endpoint. It must be a valid absolute http:// or https:// URL.
Link to an app	Associates the webhook with an API App. This is optional.
Active webhook	Allows matching events to be delivered. Turn it off to keep the configuration without delivery.

Edit, delete, and search webhooks

• Select a webhook row to open it for editing, then select Update Webhook to save changes.

• Use Delete Webhook in the edit view, or the row action menu, and confirm the deletion.

• Use the search field to find a webhook by its name, event, callback URL, security configuration, or status.

Webhook security

Select a security mode that is appropriate for the receiver and the sensitivity of the event data. HMAC and OAuth credentials are never displayed in full after saving.

Mode	What to configure
None	No verification. The interface warns that deliveries are sent without verification.
HMAC	A signing secret. Enter one or select Generate to create an HMAC-SHA-256 secret. Configure the same secret in the receiver to verify signed payloads.
OAuth 2.0	An HTTPS token URL, client ID, and secret token for OAuth 2.0 client-credential authentication.
HMAC + OAuth 2.0	Both the HMAC signing secret and the OAuth 2.0 client credentials.

CONNECTION TEST

The OAuth token URL must be an absolute https:// address. For an existing HMAC configuration, leave the secret empty to retain the existing secret.

OAUTH RULE

When HMAC or OAuth security is enabled for an active webhook, Evia Sign tests the callback endpoint and credentials before saving. The result is shown as Connection successful or Connection failed. Correct the configuration and save again if the test fails.

Recommended operating practices

• Grant only the scopes an API App or API key actually requires.

• Use HTTPS callback URLs in production, even though the interface also permits HTTP callback URLs.

• Prefer HMAC, OAuth 2.0, or HMAC + OAuth 2.0 instead of None.

• Keep client secrets, signing secrets, OAuth secrets, and API keys in a secret manager or protected environment variable.

• Rotate API keys and signing secrets in line with your security policy.

• Revoke credentials immediately when an integration is no longer trusted.

• Review app and webhook activity regularly to identify failed delivery or unexpected access.