> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formepdf.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials & Certificates

> Manage API keys and X.509 certificates on the hosted API — upload a certificate once, then certify by ID.

The **Credentials** page in the [Dashboard](https://app.formepdf.com) holds your API keys and your signing certificates.

***

## API keys

See [Authentication](https://docs.formepdf.com/hosted-api.md#authentication). In short: keys are `forme_sk_` plus 32 hex characters, shown in full only at creation, and revoked keys stop working at once.

***

## Why store certificates

Without a stored certificate, every [certify](https://docs.formepdf.com/hosted-api/certify.md) request carries the certificate and the private key:

* The private key travels over the network on every request.
* Every system that certifies needs a copy of the key.
* Rotating the key means updating every integration.

With a stored certificate, the request carries only the ID:

```json theme={null}
{
  "pdf": "<base64>",
  "certificateId": "clxyz...",
  "reason": "Approved"
}
```

***

## Uploading a certificate

On **Credentials**, add a certificate with:

1. A name, e.g. "Production Signing Cert" (up to 100 characters).
2. The X.509 certificate, PEM (`-----BEGIN CERTIFICATE-----`). It must parse as a valid X.509 certificate.
3. The RSA private key, PEM. PKCS#8 (`-----BEGIN PRIVATE KEY-----`) and PKCS#1 (`-----BEGIN RSA PRIVATE KEY-----`) both work.

The page then shows the certificate's subject common name and expiry date.

The number of certificates you can store depends on your plan. On the Free plan, it is one. See the **Billing** page for the other plans.

***

## Security

* **Encrypted at rest.** The private key is encrypted with AES-256-GCM before it is stored.
* **Never returned.** No endpoint returns the private key. [`GET /v1/certificates`](https://docs.formepdf.com/hosted-api/resources#certificates) returns only the name, subject, and expiry.
* **Deletion.** Deleting a certificate removes the certificate and its encrypted key.
* **Scope.** A certificate belongs to the account (personal or organization) that uploaded it. Only that account's API keys can use its ID.

***

## Using a certificate

```bash theme={null}
curl -X POST https://api.formepdf.com/v1/certify \
  -H "Authorization: Bearer forme_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d "{
    \"pdf\": \"$(base64 -w0 contract.pdf)\",
    \"certificateId\": \"clxyz...\",
    \"reason\": \"Approved\"
  }" \
  --output certified.pdf
```

See [Certify PDF](https://docs.formepdf.com/hosted-api/certify.md).

***

## Generating a test certificate

For development, create a self-signed certificate with OpenSSL:

```bash theme={null}
# Private key
openssl genrsa -out key.pem 2048

# Self-signed certificate, valid for 365 days
openssl req -new -x509 -key key.pem -out cert.pem -days 365 \
  -subj "/CN=Test Signer/O=Acme Corp/C=US"
```

> [!TIP]
>
> Self-signed certificates are fine for testing and internal use. PDF viewers show them as an unknown signer. For documents that outside recipients must trust, use a certificate from a Certificate Authority or your organization's PKI.

***

## Getting a production certificate

1. **Certificate Authority (CA).** Buy a document signing certificate from a CA such as DigiCert, GlobalSign, or Sectigo.
2. **Organizational PKI.** Issue a certificate from your internal CA.
3. **Government PKI.** Some jurisdictions require certificates from government-approved CAs for legal documents.

Forme supports RSA keys only. See [Digital Certification](https://docs.formepdf.com/concepts/digital-certification.md#known-limitations).

***

> [!NOTE]
>
> Stored certificates are a hosted API feature. On the [self-hosted server](https://docs.formepdf.com/api-reference/certify.md), pass the certificate and key in each request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.