> For the complete documentation index, see [llms.txt](https://docs.sign.enadocapp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sign.enadocapp.com/evia-sign-api/v2/authorization-and-authentication/api-app-credentials-and-api-keys.md). # API App credentials and API keys #### Use client credentials Open an app and select Credentials. The Client credentials card shows the client\_id and a masked secret. These credentials identify the OAuth application and are used when exchanging an authorization code for an access token. Use the copy controls only when adding them to a secure application configuration. #### Continue with OAuth authorization After the app is registered and the Client ID and Client Secret are secured, continue to the Requesting the Authorization Code step in the Evia Sign API documentation. Evia Sign redirects the user to the registered Redirect URI with the authorization result. #### Create and manage API keys 1. **Open Credentials** - Select Add API Key. 2. **Configure the key** - Enter a unique key name and select one or more scopes. An API key can use only scopes granted to its app. 3. **Create and store the key** - Select Create API key, copy the displayed value, and store it before selecting Done. The full key is shown only once. ``` Header name: X-Api-Key Value: ``` Existing keys show their status and scopes. Select Rotate to replace a valid key, or Revoke to invalidate it. A revoked key cannot be used or rotated again. #### Linked webhooks and activity Each app detail page includes Webhooks and Activity tabs. Use them to understand how an app is connected and to review its operational history.
TabWhat you can do
WebhooksReview endpoints linked to the app. Select Add webhook to create another linked endpoint, or Edit to update an existing endpoint.
ActivityReview document-access and linked-webhook activity, including status, event type, related document or request ID when available, and time.
### Webhooks Webhooks let Evia Sign send selected events to an HTTP endpoint. Configure only the event types and security controls your receiving service requires. #### Create a webhook 1. Open Webhooks. - Select New Webhook. 2. Enter webhook details. - Provide a display name, one or more events, and a valid absolute callback URL. 3. Choose the relationship. - Optionally select Link to an app. Select Standalone (No app) when the endpoint is not app-specific. 4. Set delivery state and security. - Keep Active webhook enabled to allow matching events to be delivered. Select a security mode and complete its required configuration. 5. Save. - Select Save Webhook. When HMAC or OAuth is used on an active webhook, Evia Sign tests the callback before saving.
FieldPurpose
Display nameA meaningful label, such as Request Completed.
EventsOne or more event types to deliver. Available options are provided by Evia Sign.
Callback URLThe receiving endpoint. It must be a valid absolute http:// or https:// URL.
Link to an appAssociates the webhook with an API App. This is optional.
Active webhookAllows matching events to be delivered. Turn it off to keep the configuration without delivery.
### Edit, delete, and search webhooks * Select a webhook row to open it for editing, then select Update Webhook to save changes. * Use Delete Webhook in the edit view, or the row action menu, and confirm the deletion. * Use the search field to find a webhook by its name, event, callback URL, security configuration, or status. ### Webhook security Select a security mode that is appropriate for the receiver and the sensitivity of the event data. HMAC and OAuth credentials are never displayed in full after saving.
ModeWhat to configure
NoneNo verification. The interface warns that deliveries are sent without verification.
HMACA signing secret. Enter one or select Generate to create an HMAC-SHA-256 secret. Configure the same secret in the receiver to verify signed payloads.
OAuth 2.0An HTTPS token URL, client ID, and secret token for OAuth 2.0 client-credential authentication.
HMAC + OAuth 2.0Both the HMAC signing secret and the OAuth 2.0 client credentials.
### {% hint style="info" %} **CONNECTION TEST** | The OAuth token URL must be an absolute https\:// address. For an existing HMAC configuration, leave the secret empty to retain the existing secret. | | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | {% endhint %} | {% hint style="warning" %} **OAUTH RULE** | When HMAC or OAuth security is enabled for an active webhook, Evia Sign tests the callback endpoint and credentials before saving. The result is shown as Connection successful or Connection failed. Correct the configuration and save again if the test fails. | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | {% endhint %} | ### Recommended operating practices * Grant only the scopes an API App or API key actually requires. * Use HTTPS callback URLs in production, even though the interface also permits HTTP callback URLs. * Prefer HMAC, OAuth 2.0, or HMAC + OAuth 2.0 instead of None. * Keep client secrets, signing secrets, OAuth secrets, and API keys in a secret manager or protected environment variable. * Rotate API keys and signing secrets in line with your security policy. * Revoke credentials immediately when an integration is no longer trusted. * Review app and webhook activity regularly to identify failed delivery or unexpected access.