Authorization

In the authorization step of the OAuth 2.0 Authorization Code flow:

The client redirects the user to the authorization server’s authorization endpoint.
The user logs in and grants permission for the client to access their data.
Once authorized, the authorization server redirects the user back to the client (redirect_uri) with an authorization code, which the client can later exchange for an access token.

URL

GET https://oauth.formstackservices.com/oauth2/auth?response_type=code&client_id={client_id}&redirect_uri={callback_url}&scope=openid%20email%20profile%20platform_roles%20offline_access&state={state}

Query Parameters

Parameter	Type	Optional	Description
response_type	String	false	Name of the query parameter which will be used on the `callback_url` post. This will contain the OAuth Authorization Code used to exchange for a token.
client_id	String	false	The client identifier for your integration issued by InsureSign.
redirect_uri	String	false	URL that you host which will be called by the OAuth2 process once your credentials have been authenticated. This callback will include the `response_type` parameter and the OAuth Authorization Code to be exchanged for a token.
scope	String	false	`openid email profile platform_roles offline_access`, space separated. `offline_access` is required to receive a refresh token.
state	String	false	A value of at least 8 characters, returned unchanged on the callback.

Example Request

curl 'https://oauth.formstackservices.com/oauth2/auth?
response_type=code&client_id=MyClientID&redirect_uri=https://my.domain/auth&scope=openid%20email%20profile%20platform_roles%20offline_access&state=Xk2v9QpL7rTz' -i -X GET

Example Response

HTTP/1.1 200 OK
Pragma: no-cache
X-XSS-Protection: 1; mode=block
Expires: 0
X-Frame-Options: DENY
Content-Length: 625
X-Content-Type-Options: nosniff
Content-Type: application/json;charset=UTF-8
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Cache-Control: no-cache, no-store, max-age=0, must-revalidate

{
  "access_token": "your access token",
  "expires_in": 3600,
  "token_type": "Bearer"
}

📘
Legacy API Endpoint
Through September 2026 these examples used https://sign-auth.insuresign.io. The browser step was GET /oauth2/authorize (the help article used /login). Token calls sent HTTP Basic. Use https://oauth.formstackservices.com with the paths and credential placement on this page. Migrated Authorization Code client IDs from that host send client_id and client_secret in the POST body.
API credentials issued before 15 January 2021 used https://auth.insuresign.io/.