Keys and permissions

Every call carries a workspace key:

Authorization: Bearer jd_live_…

Making a key

Keys are made on the workspace's API & agents page, with New key: in your personal workspace by you, and in a team by its owners and admins. Agent keys work on every plan, 3 active at a time below Teams & Platform. API keys need Teams & Platform. The key appears once, right after it's made. Copy it then. JustDocs keeps only a hash and can't show it again.

A key acts for the person who made it. Requests it sends go out in their name. It sees what they can see in the workspace. It stops working if they stop being an owner or admin. They need a confirmed email address to make one.

Which workspace a key works in

A key works only in the workspace it was made in: the personal workspace, or the team, whose API & agents page made it, which the page names ("Keys made here work only in Northwind"). An app that signs in with OAuth works in the workspace chosen when it was connected. A template or document in any other workspace, the same person's personal workspace included, is not found:

No template with this id in this key's workspace, "Northwind" (or its creator can't see it). A key works only in the workspace it was made in; get_workspace says which.

GET /workspace, or the get_workspace tool, says where a key is: the workspace's name ("Personal" for a personal workspace), its plan, how many templates it keeps, and what the key may do. list_templates names the workspace too, so an empty list says where it looked.

API keys and agent keys

	API key	Agent key
For	Your team's own software	An AI agent
Plan	Teams & Platform	Every plan. Up to 3 active per workspace below Teams & Platform
REST API	Yes	Yes
MCP server	No	Yes
Sends	Go out at once, unless Its sends need approval too is ticked	Always wait for approval

Each key's row on the API & agents page says what it is and what happens to its sends:

Label	Means
Agent key	A key for an AI agent, made by hand or by connecting an app. A connected app is also marked Connected app.
API key	A key for your own software, on Teams & Platform.
Sends wait for approval	Every send and intake link it asks for waits for an owner or admin. Always so for an agent key, and for an API key made to need approval.
Sends go out at once	An API key whose sends don't wait. Highlighted, because nothing stands between it and a recipient but its limits.

get_workspace gives the same as key.kind_label and key.sends_label, with key.sends_need_approval as true or false. The row's second line lists the key's permissions, sends a day, and its recipient domains, or "any recipient domain" when it has none.

Permissions

Permission	Allows	Tools and operations
read	Read templates, documents, requests and intake links	get_workspace, list_templates, get_template, get_document, list_signing_requests, get_signing_request, get_intake_request, get_approval
documents	Create templates and start documents from them	create_template, start_document
send	Send signing requests and intake links	create_signing_request, send_signing_request, void_signing_request, create_intake_request

Keys start with jd_live_.

A call without the permission gets 403 This key doesn't have the "send" permission.

Limits on a key

Setting
Recipient domains	Only these domains and their subdomains, such as example.com. Empty means any.
Sends a day	Sends in any 24 hours, through the API, the MCP server and approvals.
Days it works	The key expires after this.

Defaults and maximums are on Plans and limits.

Approval

Sends through an agent key, or an API key that needs approval, wait for a person:

• POST /signing-requests with "send": true creates the request as a draft and returns 202 with an approval whose status is pending.
• POST /signing-requests/{id}/send returns 202 with the same.
• POST /intake-requests returns 202 { "status": "awaiting_approval", "approval": … }. The intake link is created only once approved.

An owner or admin approves or declines on the workspace's Approvals page. Home lists what's waiting. Approving sends it at once, as the key's creator, after checking the key and its limits again. Follow the outcome with GET /approvals/{id} or the approval.decided webhook:

Status	Meaning
pending	Waiting for a decision.
approved	Approved and sent.
declined	Declined. Nothing was sent.
expired	Not decided within seven days, or the request was sent another way. In that case, result says so.
failed	Approved, but the send didn't go through. result says why, such as a limit reached.

Asking again to send the same signing request while its approval is pending returns that approval, not a second one.

Revoking and rotating

Revoke on the API & agents page stops a key at once. It can't be undone. To rotate a key, make the new one, switch your software over, then revoke the old one. The page shows each key's last use and the address it came from.

Keeping keys safe

• Keep keys in a secret store or environment variables. Never put them in client-side code, URLs or files you commit.
• Give each integration and each agent its own key, so you can revoke one without the others.
• Give each key only the permissions, domains and daily sends it needs.
• See the agent security checklist.