POST /v1/credential

The first call of a signing session. Find, or issue, the signer’s certificate at your provider and return its chain. SignatureAPI needs the certificate before it can compute the digest.

Request

The common request fields, nothing else. When the request resumes after a redirect, it also carries "callback": { "code": "..." }.

Response

{
    "status": "completed",
    "credential": {
        "id": "cred_7Qk...",
        "certificates": [
            "-----BEGIN CERTIFICATE-----\n...signer...\n-----END CERTIFICATE-----",
            "-----BEGIN CERTIFICATE-----\n...intermediate...\n-----END CERTIFICATE-----"
        ],
        "key_algo_oids": ["1.2.840.10045.4.3.2"],
        "expires_at": "2026-08-24T17:10:00Z"
    }
}

Field	Required	Description
credential.id	Yes	Your handle on the credential. SignatureAPI sends it back as credential_id to authorize and sign.
credential.certificates	Yes	The chain in PEM, signer certificate first. The signature must verify against the first certificate.
credential.key_algo_oids	Yes	The signature algorithms the key supports, as dotted OIDs. SignatureAPI picks one and sends it as sign_algo_oid. See Supported algorithms.
credential.expires_at	No	Set it for a certificate issued on the spot. SignatureAPI checks it before authorize and again before sign. If it has passed, the session fails with credential_expired, and the signer retries in a new session.

List only algorithms the key really supports.

The signer must identify first

If the provider must identify the signer before it can return a certificate, answer pending with an action_url. When the signer is done, send their browser to callback_url with a single-use code. SignatureAPI then calls credential again with that code, and you return the certificate.

A request that carries callback.code must get a decision: completed or failed, never pending. See Pending steps.

Static certificate

If every signer uses the same certificate and your worker can’t return it, the account can give a static certificate when it connects the worker. Signing sessions then never call credential, and authorize and sign carry "credential_id": "static".

The request authentication check still sends two POST /v1/credential requests, so serve the endpoint and authenticate it either way.