GuidesWorking with the API

Embedded signing

Let someone sign inside your own app or site: ask for a signing URL for them and open it. It’s also how test envelopes are signed, since they’re never emailed.

Create a signing URL

POST /v1/envelopes/{id}/recipients/{rid}/signing_url, with no body, returns a URL for that one recipient and when it expires. It works for live and test envelopes and needs envelopes:write.

curl -X POST https://api.skanything.io/v1/envelopes/env_4f9c2d7e1b8a4c6f9e2d3b7a1c5e8f02/recipients/rcp_1a7c3e9b5d2f4a8c6e0b9d1f3a5c7e2b/signing_url \
  -H "Authorization: Bearer $SA_API_KEY"

const res = await fetch(
  "https://api.skanything.io/v1/envelopes/env_4f9c2d7e1b8a4c6f9e2d3b7a1c5e8f02/recipients/rcp_1a7c3e9b5d2f4a8c6e0b9d1f3a5c7e2b/signing_url",
  { method: "POST", headers: { Authorization: `Bearer ${process.env.SA_API_KEY}` } },
);
const link = await res.json();
if (!res.ok) throw new Error(`${link.code}: ${link.detail}`);
// Send the signer's browser to link.url within 5 minutes.
console.log(link.url, link.expires_at);

import os
import requests

res = requests.post(
    "https://api.skanything.io/v1/envelopes/env_4f9c2d7e1b8a4c6f9e2d3b7a1c5e8f02/recipients/rcp_1a7c3e9b5d2f4a8c6e0b9d1f3a5c7e2b/signing_url",
    headers={"Authorization": f"Bearer {os.environ['SA_API_KEY']}"},
)
link = res.json()
if not res.ok:
    raise RuntimeError(f"{link['code']}: {link['detail']}")
print(link["url"], link["expires_at"])

using System.Net.Http.Headers;

using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("SA_API_KEY"));

using var res = await http.PostAsync(
    "https://api.skanything.io/v1/envelopes/env_4f9c2d7e1b8a4c6f9e2d3b7a1c5e8f02/recipients/rcp_1a7c3e9b5d2f4a8c6e0b9d1f3a5c7e2b/signing_url",
    null);
Console.WriteLine(await res.Content.ReadAsStringAsync());

{
  "url": "https://skanything.com/s/eyJhbGciOiJFUzI1NiIs…",
  "expires_at": "2026-11-04T16:10:12Z"
}

Rules

A URL is valid for 5 minutes. Create it when the person is ready to sign, and make a new one if they come back later.
It can only be made for a recipient whose turn it is (sent or viewed) on an envelope that’s sent or in_progress; otherwise 409 not_signable.
It opens the same session as the recipient’s emailed link, scoped to this one envelope, with any identity check the envelope asks for (text code or access PIN). Voiding the envelope stops it working.
The audit trail records each URL you make, with the key that made it. Each one also sends a recipient.sent webhook.
Keep the URL to the signer: anyone who opens it within the 5 minutes can act as them.