Authentication and permissions | CloudRaker documentation

Create a RakeSign key in Developers → API keys. Only an active organization administrator who manages the selected team can create its integration. Directory teams also require a verified administrator email.

Authorization: Bearer YOUR_RAKESIGN_API_KEY

Keep this key on your server. RakeSign returns its value only at creation or rotation. The public API cannot create or rotate integration credentials.

Team boundaries

Each integration belongs to one team. It can access that team’s shared signing resources when its scopes permit the operation. It cannot access participant-only documents or another team’s resources.

Integration requests create team-shared resources under the integration’s stable identity. They cannot change their team or make a document private.

The administrator who created the integration must remain an active organization administrator and team manager. RakeSign checks this membership when the integration runs. Removing that access stops the integration, including scheduled work.

Scopes

Scopes	Access
`documents:read`	List and read documents, PDFs, and audit records.
`documents:write`	Create and edit drafts, upload files, and prepare documents.
`documents:send`	Send, remind, cancel, and correct signing recipients.
`templates:read`, `templates:write`	Read templates or manage saved templates.
`contacts:read`, `contacts:write`	Read contacts and people suggestions or manage contacts.
`groups:read`, `groups:write`	Read or manage saved signing groups.
`branding:read`, `branding:write`	Read or manage signing branding.
`forms:read`, `forms:write`	Read or manage signing forms.
`jobs:read`, `jobs:write`	Inspect or manage bulk and scheduled jobs.
`reports:read`, `reports:write`	Read reports or manage report schedules.
`archive:read`, `archive:write`	Inspect archive destinations or save completed copies.
`delegations:read`	Read grants and available consent evidence.
`delegations:write`	Request consent, resend, revoke, or request renewal.
`delegations:use`	Send documents with standing delegation.
`webhooks:read`, `webhooks:write`	Inspect subscriptions and attempts or manage and replay them.

Some operations require several scopes:

Operation	Required scopes
Create a document from a template	`templates:read`, `documents:write`
Start bulk signing	`jobs:write`, `templates:read`, `documents:write`, `documents:send`
Publish a signing form	`forms:write`, `templates:read`, `documents:write`, `documents:send`
Send with standing delegation	`documents:send`, `delegations:use`
Receive document webhook events	`webhooks:write`, `documents:read`
Receive delegation webhook events	`webhooks:write`, `delegations:read`
Read reports	`reports:read`, `documents:read`
Save a signed copy	`archive:write`, `documents:read` and destination access

Keep webhooks:read on integrations that manage or receive webhook deliveries. RakeSign checks current permissions before each delivery.

Rotate and revoke

Rotation replaces the key and invalidates the previous credential at the gateway immediately. The integration ID remains the same. Update your secret store with the replacement key.

Revocation stops requests and future scheduled work. It preserves documents and audit evidence. Expiry has the same access effect when its timestamp passes.

Separate product keys

RakeSign keys work only under /v1/signing. They cannot call Paperwork, organization administration, or Workspace APIs. Existing organization API keys cannot replace a scoped RakeSign key.

Workspace record browsing and record mapping require a human session. Archive operations check the creating administrator’s current destination access before sharing a completed copy.