Last updated on
1 Apr 2026
Create and manage integration keys to authenticate API requests.
Adobe Acrobat Sign integration keys are long-lived credentials used to authenticate API requests. They allow applications and integrations to act on behalf of a user without requiring repeated sign-in. This enables automation, system-to-system communication, and integration with external platforms.
Integration keys inherit the permissions of the user who creates them. The scopes selected during creation define what the key can access, making it important to grant only the permissions required for the integration.
Access and availability
- Integration keys are available only for Enterprise accounts.
- The Integration Key link is located in Acrobat Sign API > API Information.
- If the Integration Key link is not visible, the feature is not enabled for the account.
- Contact Acrobat Sign support request access.
How integration keys work
- Integration keys authenticate API requests without requiring user interaction.
- Each key represents the user who created it and inherits that user’s permissions.
- Scopes define the level of access granted to the key.
- Keys are persistent and can be used across multiple applications.
- Keys can be revoked at any time to stop API access immediately.
Integration keys vs OAuth
- Integration keys provide direct API authentication and are commonly used for server-to-server integrations and legacy workflows.
- OAuth provides delegated, user-authorized access and supports stronger security controls, including token expiration and scoped consent.
- Integration keys are still supported for existing integrations and server-to-server workflows.
- Use OAuth when possible, especially for new integrations or when user-level access and security controls are required.
Lifecycle and behavior
- Keys are created with a defined set of scopes.
- The key name and scopes cannot be edited after creation.
- Keys remain valid for up to 10 years, or until they are revoked.
- Revoking a key immediately turns off API authentication for any application using it.
- A new key must be created to replace a revoked key.
Best practices
- Store integration keys securely and treat them as credentials.
- Limit scopes to only the permissions required.
- Use separate keys for different applications or environments.
- Revoke keys that are no longer needed.
- Rotate keys periodically to reduce risk.
Manage integration keys
Use the following tasks to manage integration keys:
