Getting started

Authentication

The Inkfree API authenticates with a single API key sent in a request header. Keys are issued from Account Settings and can be expired or revoked at any time.

On this page

Sending the key
Issuing a key
What a key is scoped to
Verifying a credential
Unauthenticated endpoints

Sending the key

Every /api/v1/inkfree/** endpoint requires an API key sent in the X-API-Key header:

http

GET /core/api/v1/inkfree/me HTTP/1.1
Host: api-uat.softsages.com
X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The header name is exactly X-API-Key. There is no Bearer prefix and no OAuth flow — send the full sk_live_… value as the header value.

Request header

X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Issuing a key

To issue a key: sign in to Inkfree, open Account Settings → API Keys, and create a key. The full sk_live_... value is displayed once, at creation — copy it immediately. Only a hash is stored server-side, so a lost key cannot be recovered and must be replaced.

Shown once, at creation

Only a hash of the key is stored server-side. If the value is lost it cannot be recovered — revoke the key and create a replacement.

Sign in to Inkfree and open Account Settings → API Keys to create, inspect, or revoke keys. API access is included on the Business plan.

What a key is scoped to

A key is bound to one account, one app, and one creator user. Envelopes created through the API are attributed to that creator user; any requestedBy supplied in a request body is ignored. Keys can carry an expiry date and can be revoked at any time from the same screen.

Attribution is fixed by the key

Envelopes created through the API are always attributed to the creator user the key is bound to. A requestedByin a request body is ignored, so a key cannot be used to send on someone else's behalf.

Verifying a credential

Call GET /api/v1/inkfree/me to confirm which account, user, and key a credential resolves to.

curl

curl "https://api-uat.softsages.com/core/api/v1/inkfree/me" \
  -H "X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

See GET /api/v1/inkfree/me for the full response schema.

Unauthenticated endpoints

Two reference endpoints under /public/inkfree need no key: the webhook event catalog and the signature verification reference. Everything under /api/v1/inkfree requires a key.