Authentication

Connect your application to a Krebit Sign organization using OAuth 2.0. A user authorizes the connection; your backend exchanges that authorization for an access token and uses a refresh token to renew it later.

Register your application

1. Sign in to https://{organization}.krebit.se/developer/my-apps and create an application.
2. Register the redirect URI where your backend handles the OAuth callback.
3. Store the client_id and client_secret securely.

For the examples, set these variables on your backend or in a local shell:

export KREBIT_DOMAIN="yourco.krebit.se"
export KREBIT_API="https://${KREBIT_DOMAIN}/api/1.0"
export KREBIT_CLIENT_ID="YOUR_CLIENT_ID"
export KREBIT_CLIENT_SECRET="YOUR_CLIENT_SECRET"
export KREBIT_REDIRECT_URI="https://yourapp.example.com/oauth/callback"

Use the organization's domain without a protocol for KREBIT_DOMAIN. Resource requests use /api/1.0; the token endpoint is /api/oauth/token.

Obtain an access token

Redirect the user to this URL, substituting and URL-encoding the query values:

https://{organization}.krebit.se/oauth/authorize?client_id={client_id}&redirect_uri={redirect_uri}&response_type=code&state={state}

Generate a random state, store it with the authorization attempt, and verify the returned value in your callback. After that check, exchange the callback's code:

export KREBIT_AUTH_CODE="CODE_FROM_VERIFIED_CALLBACK"

curl --fail-with-body --silent --show-error --request POST \
  "https://${KREBIT_DOMAIN}/api/oauth/token" \
  --header 'Accept: application/json' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode "client_id=${KREBIT_CLIENT_ID}" \
  --data-urlencode "client_secret=${KREBIT_CLIENT_SECRET}" \
  --data-urlencode "redirect_uri=${KREBIT_REDIRECT_URI}" \
  --data-urlencode "code=${KREBIT_AUTH_CODE}"

Store the returned access_token, refresh_token, and expiry information securely. For the walkthroughs, make the access token available as:

export ACCESS_TOKEN="YOUR_ACCESS_TOKEN"

Check the connection

curl --fail-with-body --silent --show-error \
  "${KREBIT_API}/me" \
  --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header 'Accept: application/json'

The response identifies the connected user. Use the same bearer header for the signing, contract, and webhook endpoints.

Refresh a token

Before the access token expires, exchange the stored refresh token:

export KREBIT_REFRESH_TOKEN="STORED_REFRESH_TOKEN"

curl --fail-with-body --silent --show-error --request POST \
  "https://${KREBIT_DOMAIN}/api/oauth/token" \
  --header 'Accept: application/json' \
  --data-urlencode 'grant_type=refresh_token' \
  --data-urlencode "client_id=${KREBIT_CLIENT_ID}" \
  --data-urlencode "client_secret=${KREBIT_CLIENT_SECRET}" \
  --data-urlencode "refresh_token=${KREBIT_REFRESH_TOKEN}"

Replace the stored credentials with the returned tokens. Keep client secrets and tokens on your backend, out of frontend code and logs.

Troubleshooting

• invalid_client — check the client credentials and organization domain.
• invalid_grant — check the authorization code or refresh token; restart authorization if it is no longer valid.
• 401 on a resource request — check or refresh the access token.
• 403 — the connected user may lack permission. Refreshing the token does not grant additional access.

See the token endpoint reference for its request and response fields.

Next step

Follow Send a PDF or Create a contract from a template. Both start from the access token and variables configured here.