Send and track signing from your own systems.

Webhooks

Events and verification.

Verifying the signature

Every delivery carries X-AccordSign-Signature: t=<unix>,v1=<hex>. The signature is HMAC-SHA256 of "{t}.{raw body}", keyed with your endpoint secret, lowercase hex. Verify against the raw bytes — re-serialising the JSON changes them. Timestamps outside a five-minute tolerance are rejected in both directions.

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(int(time.time()) - int(parts["t"])) > 300:
        return False
    expected = hmac.new(
        secret.encode(),
        f'{parts["t"]}.'.encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

Delivery, retries and disablement

Return any 2xx within ten seconds once you have durably accepted the event. Anything else counts as a failed attempt. We retry ten times on a fixed schedule — immediately, then +1m, +5m, +15m, +30m, +1h, +2h, +4h, +8h, +8h — about 24 hours end to end. Returning 410 Gone stops retries for that delivery at once. When the budget is exhausted the endpoint is disabled and the account owner is emailed; re-enabling does not replay missed events, so reconcile with the envelopes list.

Delivery is at-least-once and order is not guaranteed. De-duplicate on the event id, which is stable for a given transition. Endpoints must be absolute HTTPS URLs resolving to a public address.

Common questions.

Can I send an envelope through the API?

Yes. POST /v1/envelopes creates and sends one, either from a template — filling each role with a real recipient — or ad hoc from a document you upload first. Both modes place the fields in the request, positioned as a percentage of the page, and every signer needs at least one field or the request is refused. Send an Idempotency-Key header and retries are safe: a replay returns the original envelope rather than sending a second one.

Which plans include API access?

Growth and Enterprise. A key created on an eligible plan will start returning 403 on every call if the account is later downgraded to Starter, Individual or a trial.

Is there a sandbox?

No. There is no self-serve sandbox and no test mode. Keys are live keys, and a send through one is a real envelope emailed to a real recipient. Test against an address you control.

Do API calls use up my document allowance?

Sending does. Each send through the API consumes one document from the key owner's allowance, exactly as sending from the app does, and a send that fails before dispatch is refunded automatically. Reads, webhook deliveries and certificate or document downloads consume nothing. The other limit that applies is the per-minute request rate for your plan.

Can I connect an AI agent instead of writing code?

Yes, through the MCP connector described above. Accordsign does not include an AI. Connect the one you already use. The connector can read envelopes, create drafts and discard the drafts it created, but cannot send or void anything. The main FAQ covers what an agent can and cannot do with your account. Read the AI agent questions in the FAQ

What happens if my webhook endpoint is down?

We retry ten times over roughly 24 hours on a fixed schedule. If all attempts fail the delivery is abandoned, your endpoint is disabled and the account owner is emailed. Re-enabling does not replay the missed events — reconcile with a call to the envelopes list.