120 / min
requests per key
1 POST
to issue a certificate
HMAC
signature on every webhook
OpenAPI
spec you can generate a client from
REST that reads like the product
POST /api/v1/certificates with a template ID and recipient data; get back the certificate, its verify URL and its PDF.
Scoped keys
Create and revoke ct_ keys per integration, each with its own rate limit — a leaked key is one key, not the account.
Signed and verifiable
HMAC-signed payloads so your systems can prove a request came from you — the same discipline our verify pages apply to certificates.
Templates as an API surface
List templates and their dynamic fields programmatically; the LMS picks a design without anyone opening the dashboard.
Zapier, Make, n8n
No code at all: trigger issuance from form submissions, course completions or CRM stages through the integration platforms you already run.
Documented in the open
The API reference lives on the public docs site — endpoints, examples and error codes, no NDA required.
How it runs
- 1
Create a key
In your profile — scoped, revocable, rate-limited.
- 2
Call the API
Issue, query, list — from any language or platform.
- 3
Or skip the code
Zapier, Make and n8n cover the no-code path.
Who runs this every week
What teams ask before they start
How are API keys scoped and what happens if one leaks?
Keys are created per integration from your profile, each with its own rate limit, and revoked in one click. A leaked key is one key, not the account. Keys carry a ct_ prefix so secret scanners recognise them, and every request is logged against the key that made it.
What is the rate limit, and can we issue in bulk?
120 requests a minute per key. Bulk issuance is one request with a list of recipients, so a cohort of a thousand does not cost a thousand calls. Progress is polled per batch, and each item reports rendered, emailed, delivered or failed on its own.
How do we verify that a webhook came from CertTrigger?
Every webhook carries an X-CertTrigger-Signature header: a sha256 HMAC of the raw body using your signing secret, plus an X-CertTrigger-Event header naming the event. Compute the same HMAC on your side and compare before you trust the payload.
Do we need to write code, and is there a no-code path?
No. n8n and Activepieces run against the API today with an HTTP node and a webhook trigger. Google Forms works through a short Apps Script. Native Zapier and Make apps are in progress. The OpenAPI spec is public, so a typed client in your language is one generator run away.
The rest of the platform
Your first certificates are minutes away.
Free to start — design a template, send yourself a test, and see the verification page live.