Read a key from
your own systems.
One endpoint, one question: is this team key still live, how many seats does the band cover, and when does the period end. Ask it from a cron, a portal or a build script.
Included with both team bands at no extra charge. There is no separate API key to buy, because a key is already a key.
The API answers questions about a key. It never receives a document — there is no upload path, no multipart parser and nowhere for bytes to land. A request that carries a PDF has no route to take, and the reading, signing and exporting still happen in the holder's browser.
This paragraph is here because a licence API looks exactly like the upload APIs you have used. It is not one.
One GET, one key, one object back.
The credential is the resource. You prove what you may read by showing the thing you are asking about.
curl https://www.getsignswift.com/api/v1/licence \
-H "Authorization: Bearer ABCD-EFGH-JKLM"The key is accepted in the displayed form, bare, or lower case. Stray spaces are trimmed. Anything that is not twelve characters is refused without a lookup.
{
"valid": true,
"plan": "team20",
"planName": "Team · 20 seats",
"seats": 20,
"expires": "2027-01-14T09:00:00.000Z",
"renews": true
}The shape of a live answer. expires is the date the paid period ends, and it is the only field that decides whether the tools unlock.
200The key is live. Body is the object above.401No bearer token, a key that is not recognised, or a period that has ended. The expired flag distinguishes the last case.429More than 600 calls from one address in an hour. Retry-After says how long to wait.503The licence store did not answer. Not a refusal — retry shortly.CORS is open to every origin, because the key is yours and the answer tells you nothing you were not already entitled to. `Authorization` is not a simple header, so a browser sends a preflight first; `OPTIONS` answers it.
What the API is not.
Read-only, one question
It cannot create, revoke, rotate or list keys. Each of those would need an admin credential, and an admin credential is an account — the thing this product exists without.
Seats are a band, not a count
The number returned is what the buyer paid for. Nothing is metered, so it cannot tell you how many people are using the key, or who they are.
The key is the credential
Anyone holding it is entitled, which means don't ship it into a browser bundle you don't control. Call the endpoint from your own server and pass the answer on.
No uptime guarantee, no changelog and no versioning policy you can hold us to. There is one endpoint and it is versioned in the path, which is a promise about the address rather than about us.
A key comes with a band.
Five or twenty seats, one card, one key. The API starts working the moment the key is issued, and there is nothing to enable.