# Platform console Manage your customer workspaces, keys, webhooks, members, sign-in and billing for your platform in one place. The console is for members of a platform. To open it, choose **Platform console** in the workspace switcher or your user menu. A dark banner across the top shows you're outside a customer workspace; **Back to workspace** returns you to the app. ## Roles Each platform member has one role. A platform always keeps at least one admin. | Role | Can | | --------- | --------------------------------------------------------------------------------------------------------------------- | | Admin | Everything: members, platform and workspace keys, webhooks, settings, sign-in, the audit log and audited envelope views. | | Developer | Create, configure, suspend and resume workspaces. Review and revoke workspace keys. Can't create keys or open envelopes. | | Billing | See workspaces, usage and the billing summary. No document content. | | Support | See workspaces and usage, and open envelopes (audited). No settings. | ## Workspaces **Workspaces** lists every customer workspace with its health, status, mode, envelopes out for signature, webhook failures in the last 24 hours and envelopes sent this month. Search by name, external ID or workspace ID, and filter by **Status** and **Mode**. The health overview above the list totals your workspaces and lists the ones that need attention. Each workspace is marked **Healthy**, **Watch** or **Needs action**: - **Needs action:** a signed PDF failed or is stuck for over 15 minutes, a webhook endpoint was turned off after repeated failures, or at least 25% of webhook deliveries in the last 24 hours failed. - **Watch:** 5% or more of deliveries failed, or some deliveries were given up on or are more than 5 minutes overdue. ### Create a workspace Admins and developers choose **Create workspace** and fill in: - **Workspace name**. - **External ID** (optional): your own customer ID, unique within your platform. It can't be changed later. - **Mode**: **Test** or **Live**. It can't be changed later. - **Metadata**: up to 20 key/value pairs. Don't include credentials or document content. - **Settings**: allowed embed origins, default signing window and the signing disclosure. **Inherit default** uses the eSignStack default; **Custom** sets a value for this workspace only. - **Branding**: inherit your platform branding or pick an existing kit. - **Notification policy**: for each email, choose who sends it: **eSignStack** or **Host** (your app sends it and eSignStack stays silent). You can create the same workspaces with the API. See [eSignStack for Platforms](/docs/platform-integration-guide). ### Workspace page Open a workspace to see: - **Health**: open envelopes, envelopes expiring within 3 days, webhook failure rate and envelopes sent this month. - **Monthly usage**: counters for a month (UTC). **Export CSV** downloads them. These are usage counters, not billing charges. - **Workspace configuration**: the same fields as when you created it. Admins and developers can edit them. - **Workspace API keys**: see API keys below. - **Danger zone**: **Suspend workspace** blocks every write in the app and the API. Reads and signing links already sent keep working. **Resume workspace** turns writes back on. - **Open envelopes (audited)**: admins and support only. ## API keys Admins manage **Platform secret keys** at the bottom of the **Workspaces** page. A platform key (`sk_live_…` or `sk_test_…`) acts on any of your workspaces through the `Workspace-Id` header. Each workspace page has **Workspace API keys** (`rk_live_…` or `rk_test_…`), restricted to that workspace. To create a key, choose **Create key**, then set: - **Key name** and an optional expiry. - **Key mode**: **Test** or **Live** (workspace keys always match the workspace's mode). - **Abilities**: pick them one by one, or start from **Read only**, **Send envelopes** or **Full access**. `workspaces:export` is never part of a preset; select it only when you need it. The secret is shown once. Copy it before you close the dialog. To revoke a key, open its **…** menu and choose **Revoke**. Developers can revoke workspace keys but can't create any key. ## Envelopes Admins and support can open a workspace's envelopes from its page. Search by name, recipient name or email, and filter by status. Each envelope shows its recipients, activity and files, read-only. > [!NOTE] > Opening an envelope or downloading the **Signed PDF** or **Original PDF** is recorded in that envelope's history, with your name, role and how you signed in. The workspace can see it. ## Webhooks Admins add one endpoint here to receive events from all of your workspaces. Choose **Add endpoint**, enter the **HTTPS URL**, an optional **Description**, the **Events** (or **All events**) and whether it's **Live mode** (fixed after creation). The signing secret is shown once after you add the endpoint. For each endpoint you can **Edit**, **Disable** or **Enable**, **Send test event**, **Rotate secret** (the old secret keeps working for one hour) or **Delete**. See [Webhooks and events](/docs/webhooks) for payloads and signatures. ## Members **Members** lists the people who can open the console. Admins can change a member's role, remove a member, and invite new ones: 1. Under **Invite a member**, enter an **Email** and choose a **Role**. 2. Choose **Send invitation**. The emailed link works once and expires in 7 days. 3. The person signs in with that address (or creates an account with it) and chooses **Accept invitation**. Pending invitations show their expiry and can be revoked. Removing a member only removes console access; their eSignStack account and workspace memberships stay. ## Usage **Usage** charts one metric by day for a month, in UTC, with monthly totals below. Choose the **Month**, the **Mode** and optionally a **Workspace ID**, then **Apply**. Metrics include envelopes sent and completed, emails, SMS messages and storage. Live and test usage are kept separate. ## Audit log Admins see sign-ins, identity provider and membership changes, legal holds and other sensitive actions across the platform. Filter by event and expand a row for its details. ## Settings Admins and billing members see **Settings**: - **Billing**: the account your platform is billed to, its plan, and API and MCP envelopes used this period, with the monthly limit on extras if one is set. API sends in all your workspaces count toward this account. See [Plans and billing](/docs/plans-and-billing). - **Workspace creation** (admins): **Allow members to create standalone workspaces**. Turn it off to stop your platform members and the people in your workspaces from creating workspaces of their own. Existing workspaces aren't affected. - **Brand defaults** (admins): logo, colors, font and email wording your workspaces inherit unless they set their own, with an email preview. You can also hide the eSignStack credit. ## Sign-in (identity provider) Admins register your OpenID Connect provider here so your people can sign in with their platform account. If you set **Console MFA**, admins can open the console only after signing in through your provider with MFA. See [Platform sign-in](/docs/platform-sign-in). ## If your platform is suspended A banner says so. You can still read everything and revoke keys, but you can't create workspaces or keys or change settings.