Skip to main content

Authentication

RMS uses 2 different account types when calling the API, serving 2 different purposes:

1. API-calling account (Basic Authentication in the header)​

Authenticates the Partner's integration application when calling the RMS API — applies to every request, placed in the Authorization header:

Authorization: Basic <Base64(username:password)>
Content-Type: application/json; charset=UTF-8
User-Agent: <Partner Application>

The username/password here are self-defined by the Partner for its own integration application (not an end-user's/Subscriber's account) — when self-hosting the Sign Server, declare this list in userlist.xml (see API Integration Installation).

2. Remote signing account (user_name/pass_word in the body)​

Authenticates the Subscriber (end user) when calling the login function — this is the RMS remote signing account issued individually to each Subscriber upon CTS registration (sent via the "Remote Signing RMS Account Notification" email — see Registration & CTS Issuance Process via Portal), entirely different from the API-calling account in section 1.

Example login request:

{
  "user_name": "<Subscriber's remote signing account username>",
  "pass_word": "<Subscriber's remote signing account password>",
  "is_use_request_login": true,
  "auth_data": "<auth-data>"
}
danger

Do not use real credentials (either the API-calling account or the remote signing account) in source code, documentation, public Postman workspaces, or logs.