embed-signing-in-your-applisted

# Embed signing in your app Integration work: code you write against the REST API, not tools called on the user's behalf. This skill uses no Propper tools and needs no MCP connection — it needs API credentials, which the user gets from their Propper organization. For sending a document as a one-off task rather than as a feature, use `send-for-signature`. ## The two hosts | Host | Carries | |---|---| | `https://auth.propper.ai` | OAuth 2.0 and OIDC — `/oauth2/token`, `/oauth2/authorize`, `/.well-known/openid-configuration`, `/.well-known/jwks.json` | | `https://api.propper.ai` | Everything else — Sign, Gen, Locker, Organization | Bearer JWT on every API call. Never put credentials in client-side code: the token is minted server-side and the browser only ever sees a signing URL. ## 1. Authenticate Server-to-server integrations use the client credentials grant against `POST https://auth.propper.ai/oauth2/token`, requesting the scopes the integration actually needs — `sign:read`, `sign:write`, `sign:send` for a signing flow. Ask for `sign:send` only if the service sends; a token that cannot send cannot accidentally send. Integrations acting as a signed-in end user use the authorization code flow against `/oauth2/authorize`, with `offline_access` if the session must outlive the access token. Cache the token until shortly before it expires. Minting one per request will meet the rate limit. ## 2. Create, populate and send ``` POST /v1/sign/agreements