Formstack Sign API provides two methods for obtaining an access token, based on the client type and specific use case:

Authorization Code Flow - Involves multiple steps where the user authenticates with the authorization server, and the client exchanges an authorization code for an access token, keeping credentials secure.
Client Credentials Flow - The client authenticates with its own client_id and client_secret; no user login is involved.

Obtaining an Access Token with Authorization Code

Endpoints used by integrators to exchange an Authorization Code issued by the Authorization Code request for an Access Token which will be used by all subsequent InsureSign API calls.

URL

POST https://oauth.formstackservices.com/oauth2/token

Headers

Name	Value	Description
Content-Type	application/x-www-form-urlencoded
Authorization	InsureSign Integration credentials.	Clients with a UUID `client_id`, and all Client Credentials clients: Base64 encoded string of URL-encoded `client_id:client_secret`. Authorization Code clients with a non-UUID `client_id` do not send this header.

Request Fields

Path	Type	Optional	Description
grant_type	String	false	Value of `authorization_code` as required by the OAuth2 standard for token exchange.
client_id	String	false	Your InsureSign issued integration `client_id`.
redirect_uri	String	false	Your `callback_url` as specified in the original Get Authorization Code request.
code	String	false	The `authorization_code` issued by the Get Authorization Code request.
client_secret	String	true	Only for Authorization Code clients with a non-UUID `client_id`; send it here instead of the Authorization header.

Response Fields

Path	Type	Description
access_token	String	The OAuth access token issued by the token exchange request. This will be used as Authorization credentials on all subsequent InsureSign API calls.
refresh_token	String	The OAuth refresh token which can be used to reset the time to live for the access token.
expires_in	Long	Time in seconds that the issued access token will be valid.
token_type	String	Defines the type of access token that was granted by the token exchange.

Example Request

$ curl 'https://oauth.formstackservices.com/oauth2/token' -i -X POST \
    -H 'Authorization: Basic YourEncodedClientIdAndSecret' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=authorization_code&client_id=myclientid&redirect_uri=https%3A//048085cd.ngrok.io/auth&code=df90c9f7-680d-4843-996c-70b76f36e56b'

For Authorization Code clients with a non-UUID client_id, send the credentials in the body instead:

$ curl 'https://oauth.formstackservices.com/oauth2/token' -i -X POST \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=authorization_code&client_id=myclientid&client_secret=myclientsecret&redirect_uri=https%3A//048085cd.ngrok.io/auth&code=df90c9f7-680d-4843-996c-70b76f36e56b'

Example Response

HTTP/1.1 200 OK
Pragma: no-cache
X-XSS-Protection: 1; mode=block
Expires: 0
X-Frame-Options: DENY
Content-Length: 625
X-Content-Type-Options: nosniff
Content-Type: application/json;charset=UTF-8
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Cache-Control: no-cache, no-store, max-age=0, must-revalidate

{
  "access_token": "your access token",
  "refresh_token": "your refresh token",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Obtaining an Access Token with Client Credentials

Used for integrations configured with the Client Credentials OAuth2 Flow to authenticate. This will return a client access token which will be used to submit with all subsequent requests, providing your authorization to carry out the request.

URL

POST https://oauth.formstackservices.com/oauth2/token

Headers

Name	Value	Description
Content-Type	application/x-www-form-urlencoded
Authorization	InsureSign Integration credentials.	Base64 encoded string of URL-encoded `client_id:client_secret`

Request Fields

Path	Type	Optional	Description
grant_type	String	false	Value of `client_credentials` as required by the OAuth2 standard for Client Credential authentication.
client_id	String	false	Your InsureSign issued integration `client_id`.

Response Fields

Path	Type	Description
access_token	String	The OAuth access token issued by the token request. This will be used as Authorization credentials on all subsequent InsureSign API calls.
expires_in	Long	Time in seconds that the issued access token will be valid.
token_type	String	Defines the type of access token that was granted by the token exchange.

📘
Legacy API Endpoint
Through September 2026 these examples used https://sign-auth.insuresign.io. The browser step was GET /oauth2/authorize (the help article used /login). Token calls sent HTTP Basic. Use https://oauth.formstackservices.com with the paths and credential placement on this page. Migrated Authorization Code client IDs from that host send client_id and client_secret in the POST body.
API credentials issued before 15 January 2021 used https://auth.insuresign.io/.