API keys

Keys are created from your dashboard and look like zs_live_....

The full key is shown once, at creation. zSign stores only a hash, so we cannot retrieve or resend it — that is deliberate, and it applies to us as much as to anyone who breaches us. Put it in your secret manager immediately. If you lose it, create a new key and delete the old one.

Check your key's expiry date

Your API keys list has an Expires column. Read it — different keys get different expiries depending on how they were created:

• Keys you create in the dashboard expire after 365 days. The dashboard does not offer an expiry field, so every key made there silently takes that default.
• The key issued when you signed up does not expire. It shows Never.
• Keys created through the API take whatever you pass in expires_at, or 365 days if you omit it.

The practical consequence: a dashboard-created key that has worked for a year can stop authenticating with no change on your side. If a long-running integration starts returning auth errors and nothing was deployed, check the Expires column first.

An expired or deleted key stops authenticating immediately, so rotate by creating the replacement, deploying it, and only then deleting the old one.

If a key leaks, delete it first and investigate second. Deleting is instant and the only action that actually stops the bleeding. Then check your envelope list for anything you did not send, and contact us.

Never put a key in frontend code, a mobile app, or a public repository. Anything a browser can read, an attacker can read. For browser-side signing, use the embed flow rather than exposing a key.