Can agents work with Flowsign?

Yes, in two ways. An agent can read Flowsign through our docs, and it can act on Flowsign through the REST API.

Reading the docs

Our docs come in forms an agent can use directly. No API key needed.

• A docs MCP server at https://docs.flowsign.app/mcp. It lets an agent search and read the docs, and works with Claude Code, Cursor, Claude and VS Code.
• Plain-text exports at /llms.txt (an index of every page) and /llms-full.txt (the whole site in one file).
• Markdown pages. Add .md to any docs page URL.

The docs server is read-only, so it never touches an account. Setup steps are on the Use with AI page.

Acting through the API

To do something, an agent uses the same REST API as any other integration. Version 1 has 52 operations covering:

• Packages and templates
• Webhooks
• Library documents and custom fields
• Signing groups, workspaces and the account

With a package, an agent can:

• Create it from PDFs or from a template, then send it
• Void it, put it on hold and resume it
• Read its audit events
• Download the result as a PDF, a zip or a certificate of completion

The docs have examples in cURL, JavaScript fetch, Python requests and C#, plus the OpenAPI specification.

Webhooks save the agent from polling. Flowsign tells it when something happens. The webhooks overview has the details.

• 15 events across packages and signing sessions
• Each delivery is signed with HMAC-SHA256 in the x-flowsign-signature header
• Endpoints must be HTTPS
• Deliveries are retried and kept in a delivery log
• You can send test events while you build

A typical run looks like this:

The externalId makes the create-from-template call idempotent. An agent that retries after a timeout won't send the same package twice.

Keys and permissions

An agent signs in with a bearer API key that starts with fsk_. The key is shown once and we only store a hash of it. You decide what the agent can do:

• A key gets a role and acts with that role's permissions. It is never an owner.
• A key is bound to one workspace and can have an expiry.
• Only an owner can create or revoke keys.
• If your organisation has an IP allowlist, it applies to API calls too.
• Requests are limited to 120 every 60 seconds.

Our tip: give the agent its own key, on the narrowest role that does the job, with an expiry. The authentication page covers each of these.

The API, API keys and webhooks are on the Enterprise plan. See pricing for what each plan includes.

A human still signs

An agent prepares and sends. It doesn't sign. The recipient still opens the package, reads it and signs it themselves.

• Once a recipient has opened a package, it is tamper-evident.
• Every action lands in the audit trail, whether a person or a key took it.