Web pages and apps
Your API key stays on your server. When a web page or a mobile app needs to call Signa itself, to sign as a visitor types, to subtitle a file they pick, or to go live from their microphone, your server gives it a client token that works for a few minutes.
How it fits together
- The page asks your server for a token (after your own sign-in, if you have one).
- Your server asks Signa for a client token with its API key, and passes it on.
- The page calls Signa directly with the token, from any website: signing, videos, subtitles, speech and live.
- When the token expires, the page asks for a new one.
Making a token, on your server
POST
/v1/api/client-tokens| Field | Required | Details |
|---|---|---|
ttlSeconds | No | How long the token works: up to 3600 (an hour). Default 600 (ten minutes). |
curl -X POST https://api.usesigna.org/v1/api/client-tokens \
-H "Authorization: Bearer $SIGNA_KEY" \
-H "Content-Type: application/json" \
-d '{"ttlSeconds": 600}'The answer is {"token": "ct_…", "expiresAt": "2026-10-24T09:10:00Z"}. Use the token exactly like the key: Authorization: Bearer ct_…, or as the token of a live session.
What a client token can do
| Client token | API key | |
|---|---|---|
| Sign, videos, subtitles, speech, live | Yes | Yes |
| Sign onto an overlay | Yes | Yes |
| Create or delete overlays | No | Yes |
| Make client tokens | No | Yes |
| Works from any website (CORS) | Yes | Never put a key in a page |
| Lifetime | Up to an hour | Until revoked |
Give tokens to your own users only
Everything a token does counts against your plan. Hand them out behind your own sign-in, or limit how often one visitor can ask, the way you would for any paid service.