Protect API tokens, and call the signing endpoints with a client certificate.
Treat tokens like passwords. Don’t print them in logs or store them in source control.
Use a dedicated API user for each integration, with only the permissions it needs.
Tokens are short-lived. When a call returns 403 (Token Expired), generate a new token on the Swagger API page.
API keys generated in System Setup > User expire after 30, 60 or 90 days. Renew them before they expire.
Signing endpoints are served over mutual TLS. Send the client authentication certificate issued for your signing account together with the token, for example with curl:
curl -X POST \
--cert-type P12 --cert client.pfx:<certificate password> \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"certificate_name":"<certificate name>","hash":"<base64 hash>"}' \
https://codesign.example.com/api/signing/sign
Replace client.pfx and <certificate password> with your client certificate and its password. For how these certificates are issued and protected, see Client Authentication.
The API is served over HTTPS only. Keep certificate validation turned on in scripts; if a script can’t validate the portal certificate, trust the CA that issued it rather than skipping the check.