> This page is for RakeSign.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.cloudraker.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.cloudraker.com/_mcp/server.

# Manage integrations

Organization administrators can open **Developers** and **Delegations** in the RakeSign sidebar.
An administrator must also manage a team to grant integration access to that team.

## Environment prerequisite

The CloudRaker operator must enable `api-key:signing-only` in the WorkOS environment before administrators can create integration keys.
In WorkOS, open **Authorization → Configuration → Organization API key permissions** and add that permission.
Follow the [WorkOS API key setup guide](https://workos.com/docs/authkit/api-keys#configuring-available-permissions).

RakeSign stores each integration's team and detailed scopes separately.
The WorkOS permission restricts its credential to the RakeSign API.
If this prerequisite is missing, key creation returns `503` and does not issue a credential.
Contact CloudRaker support if you cannot access the environment configuration.

## Create an API key

1. Open **Developers → API keys**.
2. Select **Create API key**.
3. Enter the integration name and choose a team you manage.
4. Select the required permissions and an optional expiry.
5. Create the key and copy its value into your server's secret store.

RakeSign shows the key value once.
The key list shows permissions, expiry, and last use without exposing the secret.
Read [authentication and permissions](/rakesign/developers/authentication) before choosing scopes.

## Change access

Use **Edit** to change an integration's name, permissions, or expiry.
The team stays fixed.
Create a separate integration for another team.

Use **Rotate key** to replace the credential.
Rotation invalidates the previous key immediately at the RakeSign gateway.
It preserves the integration identity and its existing documents.

Use **Revoke key** to stop the integration.
Revocation does not delete its documents or completed signatures.
Scheduled work checks the current grant before it continues.

## Inspect requests

Open **Usage and requests** to see recorded request counts, failures, and recent request metadata.
Each row includes the method, route, status, duration, request ID, integration ID, and key ID.
Request history excludes request bodies, document contents, and credentials.
Raw request records expire after 90 days.
Tenant maintenance runs daily, including when the integration stops making requests.

Use the request ID when you report a failed API call.
These counts describe recorded requests, not billing totals.

## Manage webhooks

Open **Webhooks** to register a public HTTPS endpoint and choose its team and event types.
Use **Delivery history** to inspect attempts and response statuses.
After you fix your receiver, select **Replay** for a recorded event.

Replay keeps the same event ID.
Your receiver must deduplicate events before it performs work.
Read [webhooks](/rakesign/developers/webhooks) for signature verification and retry rules.

## Manage consent

Open **Delegations** and select **Request consent**.
Choose a saved template revision, then enter the signer's name, email, and language.
Sending the request does not activate consent.

Open a grant to see its status, consent evidence, signature history, and renewal links.
Available actions depend on the grant's current state.
Revocation stops future use and preserves previous evidence.
Renewal asks the signer to make a new decision.