API client access
Application credentials belong to the deployment environment. Keep them server-side, least-privileged and revocable.
DEVELOPER
API authentication and access
Separate application access from user signing authorization; assign secret storage and revocation ownership.
ON THIS PAGE
Separate authentication and signing authority
Backend authentication, SSO sessions, Viewer sessions and SAD have different roles. Select the route contract before implementation; do not reuse tokens beyond confirmed purposes.
Practice the offline reconciliation journalAuthentication and token scopes differ
SIC describes Basic at login and Bearer for service operations. Gateway authentication placement remains unclear. File, signing and Viewer tokens and SAD do not replace application tokens; keep secrets out of the frontend.
Application access and signing authorization
RSS describes obtaining tokens through SSO; SIC describes auth/login and Bearer access for subsequent operations. Service access does not replace user signing approval. SIC authorize binds the request to digests; SAD is used for signing under the contract.
ACCESS
Two separate authorization boundaries
User signing authorization
Successful login is not signing consent. Bind authorization to the document, signer and transaction.
DEPLOYMENT RECORD
Confirm before integration
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Item | Required decision |
|---|---|
| Authentication | Obtain the approved mechanism; do not infer OAuth, API keys or Bearer tokens. |
| Permissions | Confirm application, tenant, environment and operation permissions. |
| Secrets | Assign storage, rotation and revocation; exclude secrets from ZIP files and logs. |
| Testing | Test missing, expired and revoked access using the approved mechanism. |