Skip to main content
The Credentials page in the Dashboard holds your API keys and your signing certificates.

​
API keys

See Authentication. In short: keys are forme_sk_ plus 32 hex characters, shown in full only at creation, and revoked keys stop working at once.

​
Why store certificates

Without a stored certificate, every certify request carries the certificate and the private key:
  • The private key travels over the network on every request.
  • Every system that certifies needs a copy of the key.
  • Rotating the key means updating every integration.
With a stored certificate, the request carries only the ID:

​
Uploading a certificate

On Credentials, add a certificate with:
  1. A name, e.g. “Production Signing Cert” (up to 100 characters).
  2. The X.509 certificate, PEM (-----BEGIN CERTIFICATE-----). It must parse as a valid X.509 certificate.
  3. The RSA private key, PEM. PKCS#8 (-----BEGIN PRIVATE KEY-----) and PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) both work.
The page then shows the certificate’s subject common name and expiry date. The number of certificates you can store depends on your plan. On the Free plan, it is one. See the Billing page for the other plans.

​
Security

  • Encrypted at rest. The private key is encrypted with AES-256-GCM before it is stored.
  • Never returned. No endpoint returns the private key. GET /v1/certificates returns only the name, subject, and expiry.
  • Deletion. Deleting a certificate removes the certificate and its encrypted key.
  • Scope. A certificate belongs to the account (personal or organization) that uploaded it. Only that account’s API keys can use its ID.

​
Using a certificate

See Certify PDF.

​
Generating a test certificate

For development, create a self-signed certificate with OpenSSL:
Self-signed certificates are fine for testing and internal use. PDF viewers show them as an unknown signer. For documents that outside recipients must trust, use a certificate from a Certificate Authority or your organization’s PKI.

​
Getting a production certificate

  1. Certificate Authority (CA). Buy a document signing certificate from a CA such as DigiCert, GlobalSign, or Sectigo.
  2. Organizational PKI. Issue a certificate from your internal CA.
  3. Government PKI. Some jurisdictions require certificates from government-approved CAs for legal documents.
Forme supports RSA keys only. See Digital Certification.
Stored certificates are a hosted API feature. On the self-hosted server, pass the certificate and key in each request.