> For the complete documentation index, see [llms.txt](https://2sign-co-il.gitbook.io/2sign.co.il-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://2sign-co-il.gitbook.io/2sign.co.il-docs/getting-started/authentication.md).

# Authentication

All API requests must be authenticated. First, call the login endpoint to receive an access token. Then send that token in the Authorization header of every subsequent request.

You can authenticate in one of two ways:

| Method                        | Recommended for                             |
| ----------------------------- | ------------------------------------------- |
| **Client ID + Client Secret** | Integrations, servers and automated systems |
| **Email + Password**          | Testing and manual use                      |

This page focuses on the Client ID + Client Secret flow.

***

### Step 1: Get your Client ID and Client Secret

1. Log in to the 2Sign system.
2. Go to **Settings > API**.
3. Copy the **Client ID**.
4. Click **Generate** next to **Client Secret**.
5. **Copy the Client Secret and store it securely**, then click **Save**.

{% hint style="danger" %}
**Copy the Client Secret before clicking Save.** After you save, the value is displayed in an encrypted format and can no longer be used for authentication. The original value cannot be retrieved. If you missed it, click **Generate** again, copy the new value, and then Save.
{% endhint %}

The Client Secret is a GUID in this format:

```
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
```

No additional activation is required on the account.

***

### Step 2: Request an access token

Send a `POST` request to `/api/Account/LoginApi`.

#### Option A: Client ID and Client Secret

```json
{
  "GrantType": "client",
  "ClientId": "<your_client_id>",
  "ClientSecret": "<your_client_secret>"
}
```

| Field          | Description                                           |
| -------------- | ----------------------------------------------------- |
| `GrantType`    | Must be `"client"`                                    |
| `ClientId`     | The **Client ID** from Settings > API                 |
| `ClientSecret` | The **Client Secret** you generated in Settings > API |

#### Option B: Email and password

```json
{
  "Email": "<your_email>",
  "Password": "<your_password>"
}
```

#### Example request

{% tabs %}
{% tab title="Client Secret" %}

```json
{
 "GrantType":"client",
 "ClientId":"966gdb1-1124-461a-ae94-aac72146b5b",
 "ClientSecret":"248dge4-3f8f-4433-af550b-fret656ff3af",
 }
```

{% endtab %}

{% tab title="Email + Password" %}

```json
{
  "Email": "user@example.com",
  "Password": "YOUR_PASSWORD"
}
```

{% endtab %}
{% endtabs %}

#### Example response

```json
{
  "access_token": "<your_access_token>"
}
```

{% hint style="warning" %}
Do **not** add other fields (such as `Url`, `Guid` or `Code`) to this request.
{% endhint %}

***

### Step 3: Use the access token

Extract the value of the `access_token` field and send it in the `Authorization` header of every request:

```
Authorization: Bearer <your_access_token>
```

***

### Security best practices

* Treat the Client Secret like a password.
* Store it in a secure place (environment variable or secrets manager).
* Never expose it in public repositories, client-side code, or logs.
* Never send it in support emails, tickets or screenshots. Always mask it.

{% hint style="info" %}
Keep your Client Secret private. Do not share it or commit it to source control. Store it in your application's secure configuration.
{% endhint %}

***

### Troubleshooting

| Problem                                          | What to check                                                                                                 |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- |
| `400 Bad Request`                                | Make sure the body is valid JSON (no trailing commas) and that `GrantType` is `"client"`.                     |
| Authentication fails with a valid-looking secret | The Client Secret may have been copied after saving. Generate a new one and copy it **before** clicking Save. |
| Lost the Client Secret                           | It cannot be retrieved. Generate a new one in **Settings > API**.                                             |
| Unsure which value goes where                    | `ClientId` ← **Client ID**, `ClientSecret` ← **Client Secret**, both from **Settings > API**.                 |

#### Error: `token wasnt created`

Check the following:

1. The Client Secret was generated successfully in **API Settings**.
2. You copied the value **before** clicking Save (a Client Secret copied after saving will not work).
3. The Client ID and Client Secret belong to the same account/pair.
4. You are sending the request to `POST /api/Account/LoginApi`.
5. You are using the Client Secret and **not** the API Key.
6. The body does not contain extra fields such as `Url`, `Guid` or `Code`.

If the error persists, contact 2Sign support and include:

* The endpoint and HTTP method
* The request body (**with the Client Secret masked**)
* The full error response
* Any request / correlation ID, if available

***

## POST /api/Account/LoginApi

> LoginApi

```json
{"openapi":"3.1.1","info":{"title":"Customer API","version":"1.0.0"},"servers":[{"url":"/"}],"paths":{"/api/Account/LoginApi":{"post":{"tags":["Account"],"summary":"LoginApi","operationId":"LoginApi_POST","responses":{"200":{"description":"Success (Custom Example)","content":{"application/json":{"schema":{"type":"string"}}}},"400":{"description":"Bad Request"},"500":{"description":"Internal Server Error"}},"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LoginViewModel"}}},"required":true}}}},"components":{"schemas":{"LoginViewModel":{"type":"object","properties":{"Email":{"type":"string"},"Password":{"type":"string"},"RememberMe":{"type":"boolean"},"GrantType":{"type":"string"},"ClientId":{"type":"string"},"ClientSecret":{"type":"string"},"Code":{"type":"string"},"PhoneNumber":{"type":"string"},"Url":{"type":"string"},"Guid":{"type":"string"},"OTPResendAttempts":{"type":"integer"},"Is2faMode":{"type":"boolean"},"Authenticators":{"type":"string"},"Emailmp":{"type":"string"},"UserIdOuterEnc":{"type":"string"}},"required":["RememberMe"]}}}}
```