Platform console

Manage your customer workspaces, keys, webhooks, members, sign-in and billing for your platform in one place.

The console is for members of a platform. To open it, choose Platform console in the workspace switcher or your user menu. A dark banner across the top shows you're outside a customer workspace; Back to workspace returns you to the app.

Roles

Each platform member has one role. A platform always keeps at least one admin.

Role	Can
Admin	Everything: members, platform and workspace keys, webhooks, settings, sign-in, the audit log and audited envelope views.
Developer	Create, configure, suspend and resume workspaces. Review and revoke workspace keys. Can't create keys or open envelopes.
Billing	See workspaces, usage and the billing summary. No document content.
Support	See workspaces and usage, and open envelopes (audited). No settings.

Workspaces

Workspaces lists every customer workspace with its health, status, mode, envelopes out for signature, webhook failures in the last 24 hours and envelopes sent this month. Search by name, external ID or workspace ID, and filter by Status and Mode.

The health overview above the list totals your workspaces and lists the ones that need attention. Each workspace is marked Healthy, Watch or Needs action:

Needs action: a signed PDF failed or is stuck for over 15 minutes, a webhook endpoint was turned off after repeated failures, or at least 25% of webhook deliveries in the last 24 hours failed.
Watch: 5% or more of deliveries failed, or some deliveries were given up on or are more than 5 minutes overdue.

Create a workspace

Admins and developers choose Create workspace and fill in:

Workspace name.
External ID (optional): your own customer ID, unique within your platform. It can't be changed later.
Mode: Test or Live. It can't be changed later.
Metadata: up to 20 key/value pairs. Don't include credentials or document content.
Settings: allowed embed origins, default signing window and the signing disclosure. Inherit default uses the eSignStack default; Custom sets a value for this workspace only.
Branding: inherit your platform branding or pick an existing kit.
Notification policy: for each email, choose who sends it: eSignStack or Host (your app sends it and eSignStack stays silent).

You can create the same workspaces with the API. See eSignStack for Platforms.

Workspace page

Open a workspace to see:

Health: open envelopes, envelopes expiring within 3 days, webhook failure rate and envelopes sent this month.
Monthly usage: counters for a month (UTC). Export CSV downloads them. These are usage counters, not billing charges.
Workspace configuration: the same fields as when you created it. Admins and developers can edit them.
Workspace API keys: see API keys below.
Danger zone: Suspend workspace blocks every write in the app and the API. Reads and signing links already sent keep working. Resume workspace turns writes back on.
Open envelopes (audited): admins and support only.

API keys

Admins manage Platform secret keys at the bottom of the Workspaces page. A platform key (sk_live_… or sk_test_…) acts on any of your workspaces through the Workspace-Id header. Each workspace page has Workspace API keys (rk_live_… or rk_test_…), restricted to that workspace.

To create a key, choose Create key, then set:

Key name and an optional expiry.
Key mode: Test or Live (workspace keys always match the workspace's mode).
Abilities: pick them one by one, or start from Read only, Send envelopes or Full access. workspaces:export is never part of a preset; select it only when you need it.

The secret is shown once. Copy it before you close the dialog. To revoke a key, open its … menu and choose Revoke. Developers can revoke workspace keys but can't create any key.

Envelopes

Admins and support can open a workspace's envelopes from its page. Search by name, recipient name or email, and filter by status. Each envelope shows its recipients, activity and files, read-only.

Note

Opening an envelope or downloading the Signed PDF or Original PDF is recorded in that envelope's history, with your name, role and how you signed in. The workspace can see it.

Webhooks

Admins add one endpoint here to receive events from all of your workspaces. Choose Add endpoint, enter the HTTPS URL, an optional Description, the Events (or All events) and whether it's Live mode (fixed after creation).

The signing secret is shown once after you add the endpoint. For each endpoint you can Edit, Disable or Enable, Send test event, Rotate secret (the old secret keeps working for one hour) or Delete. See Webhooks and events for payloads and signatures.

Members

Members lists the people who can open the console. Admins can change a member's role, remove a member, and invite new ones:

Under Invite a member, enter an Email and choose a Role.
Choose Send invitation. The emailed link works once and expires in 7 days.
The person signs in with that address (or creates an account with it) and chooses Accept invitation.

Pending invitations show their expiry and can be revoked. Removing a member only removes console access; their eSignStack account and workspace memberships stay.

Usage

Usage charts one metric by day for a month, in UTC, with monthly totals below. Choose the Month, the Mode and optionally a Workspace ID, then Apply. Metrics include envelopes sent and completed, emails, SMS messages and storage. Live and test usage are kept separate.

Audit log

Admins see sign-ins, identity provider and membership changes, legal holds and other sensitive actions across the platform. Filter by event and expand a row for its details.

Settings

Admins and billing members see Settings:

Billing: the account your platform is billed to, its plan, and API and MCP envelopes used this period, with the monthly limit on extras if one is set. API sends in all your workspaces count toward this account. See Plans and billing.
Workspace creation (admins): Allow members to create standalone workspaces. Turn it off to stop your platform members and the people in your workspaces from creating workspaces of their own. Existing workspaces aren't affected.
Brand defaults (admins): logo, colors, font and email wording your workspaces inherit unless they set their own, with an email preview. You can also hide the eSignStack credit.

Admins register your OpenID Connect provider here so your people can sign in with their platform account. If you set Console MFA, admins can open the console only after signing in through your provider with MFA. See Platform sign-in.

If your platform is suspended

A banner says so. You can still read everything and revoke keys, but you can't create workspaces or keys or change settings.