Authentication

All API requests require authentication. Most APIs accept an API key or an OAuth 2.0 access token; the Click API accepts OAuth 2.0 access tokens only.

API Keys

API keys are not accepted by the Click API: use OAuth 2.0 with the click:* scopes (see the Click quickstart).

Include your API key in the Authorization header:

curl -X GET "https://api.propper.ai/v1/documents" \
  -H "Authorization: Bearer YOUR_API_KEY"

Obtaining an API Key

1. Log in to your Propper Dashboard
2. Navigate to Settings → API Keys
3. Click Create API Key
4. Copy and securely store your key

caution

API keys grant full access to your account. Never expose them in client-side code or public repositories.

OAuth 2.0

For applications acting on behalf of users, use OAuth 2.0 with the Client Credentials flow.

Creating an OAuth Client

1. Log in to your Propper Dashboard
2. Navigate to Settings → Developers
3. Click Create OAuth Client
4. Enter a name for your application (e.g., "My Integration")
5. Select the scopes your application requires (see Available Scopes below)
6. Click Create
7. Copy your Client ID and Client Secret

caution

The client secret is only shown once. Store it securely - you cannot retrieve it later.

Requesting an Access Token

Exchange your client credentials for an access token:

curl -X POST "https://auth.propper.ai/oauth2/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "scope": "sign:read sign:write"
  }'

Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "sign:read sign:write"
}

tip

Access tokens expire in 1 hour. Cache them and refresh before expiry to avoid unnecessary token requests.

Using the Access Token

Include the access token in the Authorization header for all API requests:

curl -X GET "https://api.propper.ai/restapi/v2.1/accounts/{accountId}/envelopes" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Available Scopes

Scope	Description
sign:read	Read documents and signatures
sign:write	Create and send documents
click:accept	Record acceptances, with no access to read Click data
click:read	Read agreements and acceptances
click:write	Create and manage agreements
click:admin	Full Click management access, including deletes

Organization Context

All requests are scoped to your organization. The organization is determined by your API key or OAuth token.