OneSpan Sign
Connect OneSpan Sign to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect OneSpan Sign to collect digital signature evidence with automated compliance tests, switched on per workspace.
| Category | Digital Signature |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| OneSpan Sign's guide | docs.onespan.com |
Connect with an API token
-
In OneSpan Sign:
- Sign in to OneSpan Sign as the account owner (only an account owner can view the API key; with Roles and Permissions enabled, a role with the API Access permission can open the page).
- Click Admin › API Access. Under authentication method, make sure API KEY is selected and click Save if you changed it.
- In the API Key section of the Authentication page, click View API Key (it is masked by default) and copy it.
Where to find the other values:
- Instance URL: The OneSpan Sign address you sign in to (your environment's host). The fetched page does not list the environment URLs.
The API key may not be visible depending on your environment and privileges; if API Key, API Token or OAuth 2.0 have not been enabled, contact OneSpan Support. OneSpan recommends OAuth 2.0 client credentials or Client Apps over the fixed API key: the API key never expires and there is only one per account. Client Apps (Admin > API Access > Client Apps > Create) and OAuth 2.0 clients show the secret only once and issue short-lived tokens (OAuth tokens expire after 5 minutes). The selected authentication method on the API Access page applies to all REST calls, so changing it can break existing integrations.
Source: docs.onespan.com, docs.onespan.com, checked 2026-10-07.
The permissions Safeguard needs:
account manager. -
On Compliance › Connectors, open OneSpan Sign, click Connect, choose API token and fill in:
Field What to enter API key Required. Stored encrypted and never shown again. Instance URL Required. For example: https://apps.esignlive.com -
Click Connect with token.
Frameworks
Safeguard's automated tests read OneSpan Sign and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Digital Signature connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks