What happens if my server is down when the callback is sent?

It is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours. Every attempt is listed under the key, and you can resend any callback by hand.

How do I know a callback really came from you?

Each one is signed with your key's signing secret. The docs show how to check the signature in Node.js, Python and PHP.

Does issuing through the API cost more?

No. Each person costs one certificate from your balance, the same as in the app, charged when the request is accepted. A request that fails validation costs nothing.

Can every design be issued through the API?

Any saved design without a table. Designs with tables, such as grades per student, are issued from the app with a spreadsheet.

Issuing API

Issue certificates the moment they're earned.

Your LMS, student system or HR platform sends people as JSON. We render each certificate from your design and post the PDF, preview and verification link straight back to you.

Start free Book a demo Read the docs

202
accepted in one call: 6
callback attempts, signed: 0
spreadsheets to export

JSON request with recipient details for certificate issuance

Why it matters

Certificates shouldn't wait for someone to export a spreadsheet

Copying between systems breaks things

Every export and re-import is a chance to misspell a name or drop a row, and nobody notices until the certificate is printed.

Recipients wait for the next batch

A learner finishes today, but their certificate goes out when someone next has time to run a batch.

No clear record of what was issued

When issuing happens by hand, it's hard to answer "which of our people got which certificate, and when?"

With the Issuing API, the system that knows someone has finished issues their certificate at that moment, and gets back everything it needs to store and share it.

How it works

From start to finish in 4 steps

Step 01
Create a key for your designs
In Settings → API keys, create a key and tick the designs it may issue. Add a callback URL and keep the key on your server.
01
Step 02
Get the exact request
Open a design and click Use via API. It shows the endpoint, every field the design needs, a ready-to-send body and a sample callback.
02
Step 03
Send the people
POST up to your per-request limit of people with their field values. You get a 202 and a request id straight away; rendering happens in the background.
03
Step 04
Receive the result
For each person, a signed POST reaches your callback with the serial number, verification link, and links to the PDF and preview. Or poll the status endpoint instead.
04

In code

One request in. One signed callback per person out.

Read the full docs

You send

curl -X POST "https://YOUR-SITE/api/public/v1/designs/DESIGN_ID/issue" \
  -H "Authorization: Bearer $CERTIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-0001" \
  -d '{
    "recipients": [{
      "reference": "STU-0042",
      "fields": {
        "name": "Amara White",
        "course": "Master of Business Administration"
      },
      "email": "amara@example.org"
    }],
    "sendEmail": true
  }'

You receive

POST /hooks/certify
X-Certify-Event: credential.issued
X-Certify-Signature: t=1790000000,v1=5f2c…

{
  "event": "credential.issued",
  "reference": "STU-0042",
  "status": "issued",
  "serialNumber": "NBS-2026-000417",
  "verifyUrl": "https://YOUR-SITE/verify/K7M2QX9FTB4A",
  "documentUrl": "…/credentials/c0ffee00-…/document",
  "previewUrl": "…/credentials/c0ffee00-…/preview",
  "issuedAt": "2026-09-21T09:30:00Z"
}

What you get

Built for the details that make it trustworthy

Keys scoped to designs

A key can only issue and read the designs you tick for it, in your own organisation.

Safe to retry

Send an Idempotency-Key and a repeated request returns the first result instead of issuing twice.

All or nothing

Every person is checked first. If one has a problem, nothing is issued or charged, and you get every error at once.

Signed callbacks

Each callback carries an HMAC-SHA256 signature and timestamp, with verification examples for Node.js, Python and PHP.

Retries built in

Missed callbacks are retried over six hours, logged under the key, and can be resent by hand.

Links that never expire

Document and preview links point at the certificate, not the key, so rotating a key never breaks them.

Optional email delivery

Set sendEmail and each person is emailed their certificate once it's issued.

Rotate or revoke anytime

Rotate a key's secret or revoke it outright. Everything it issued stays readable.

Clear limits

60 requests a minute per key, with Retry-After on a 429, so your integration can pace itself.

Who it's for

Wherever proof of achievement matters

Learning platforms (LMS)

Issue a course certificate the moment a learner passes the final module.

Student information systems

Issue degrees and transcripts from the same system that records graduation.

HR and compliance tools

Issue training and onboarding certificates as employees complete them.

Exam and assessment platforms

Issue results certificates as soon as marks are released.

Event platforms

Issue attendance certificates when attendees check in or finish a session.

Membership systems

Issue membership and licence certificates on sign-up or renewal.

Questions people ask

10 by default; your platform administrator can raise it to as many as 200. For larger groups, send several requests, or upload a spreadsheet in the app.

Connect your system this week

Create a key, copy the request from Use via API, and your first certificate can be issued from your own code today.

Start free Book a demo Talk to us

Works well with

Certificate GenerationDesign once, issue thousands, verify forever Digital SignaturesSend, sign and track documents