ClickTerm Docs — Clickwrap Consent Management

Prerequisites: A completed SDK integration that returns a Signature, and your App ID + App Key for server-side calls.

After your end user accepts or declines a clickwrap, the SDK creates an event in ClickTerm and returns a Signature. The event remains unverified until your backend sends this Signature to ClickTerm’s verification endpoint. Verification confirms the Signature hasn’t been forged or tampered with and marks the event as verified. For accepted events, a Certificate of Acceptance is generated. Why it matters: Verification ensures the Signature hasn’t been forged or tampered with, providing proof of consent, security, and legal validity for clickwrap agreements.

Never expose your App Key in client-side code. The App Key is used only for backend verification calls. The client SDK uses only the App ID. Store the App Key safely — it won’t display again after creation, but can be regenerated. Regenerating the key requires updating your backend configuration.

Endpoint

POST https://api.clickterm.com/public-client/v1/clickwrap/verify

Request

HttpResponse<String> response = Unirest.post(
    "https://api.clickterm.com/public-client/v1/clickwrap/verify")
  .header("X-APP-ID", "YOUR_APP_ID")
  .header("X-APP-KEY", "YOUR_APP_KEY")
  .header("Content-Type", "application/json")
  .body("{\"clicktermSignature\":\"SIGNATURE_FROM_SDK\"}")
  .asString();

const response = await fetch(
  "https://api.clickterm.com/public-client/v1/clickwrap/verify",
  {
    method: "POST",
    headers: {
      "X-APP-ID": process.env.CLICKTERM_APP_ID,
      "X-APP-KEY": process.env.CLICKTERM_APP_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      clicktermSignature: signatureFromSdk,
    }),
  }
);
const event = await response.json();

import requests

response = requests.post(
    "https://api.clickterm.com/public-client/v1/clickwrap/verify",
    headers={
        "X-APP-ID": CLICKTERM_APP_ID,
        "X-APP-KEY": CLICKTERM_APP_KEY,
        "Content-Type": "application/json",
    },
    json={"clicktermSignature": signature_from_sdk},
)
event = response.json()

Request body

Parameter	Required	Description
`clicktermSignature`	Yes	The Signature returned by the SDK after the user’s action

Response

On success the endpoint returns the verified clickwrap event — its status (ACCEPTED or DECLINED), event and template IDs, template version, placeholder values, technical metadata, and timestamps. For accepted events, a Certificate of Acceptance is generated. See the verify endpoint reference for the full response schema and field descriptions.

Framework examples

@RestController
@RequestMapping("/api")
public class ConsentController {

    @Value("${clickterm.app-id}")
    private String appId;

    @Value("${clickterm.app-key}")
    private String appKey;

    @PostMapping("/verify-consent")
    public ResponseEntity<?> verifyConsent(@RequestBody Map<String, String> body) {
        HttpResponse<String> response = Unirest.post(
            "https://api.clickterm.com/public-client/v1/clickwrap/verify")
          .header("X-APP-ID", appId)
          .header("X-APP-KEY", appKey)
          .header("Content-Type", "application/json")
          .body(Map.of("clicktermSignature", body.get("clicktermSignature")))
          .asString();

        // Parse and handle the response
        return ResponseEntity.ok(response.getBody());
    }
}

const express = require("express");
const router = express.Router();

router.post("/verify-consent", async (req, res) => {
  const { clicktermSignature } = req.body;

  const response = await fetch(
    "https://api.clickterm.com/public-client/v1/clickwrap/verify",
    {
      method: "POST",
      headers: {
        "X-APP-ID": process.env.CLICKTERM_APP_ID,
        "X-APP-KEY": process.env.CLICKTERM_APP_KEY,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ clicktermSignature }),
    }
  );

  const event = await response.json();

  if (event.clickwrapEventStatus === "ACCEPTED") {
    // Proceed with registration or flow
    res.json({ success: true, eventId: event.clickwrapEventId });
  } else {
    res.status(403).json({ success: false, status: event.clickwrapEventStatus });
  }
});

module.exports = router;

import requests
from django.http import JsonResponse
from django.views.decorators.http import require_POST
from django.conf import settings

@require_POST
def verify_consent(request):
    import json
    body = json.loads(request.body)

    response = requests.post(
        "https://api.clickterm.com/public-client/v1/clickwrap/verify",
        headers={
            "X-APP-ID": settings.CLICKTERM_APP_ID,
            "X-APP-KEY": settings.CLICKTERM_APP_KEY,
            "Content-Type": "application/json",
        },
        json={"clicktermSignature": body["clicktermSignature"]},
    )
    event = response.json()

    if event["clickwrapEventStatus"] == "ACCEPTED":
        return JsonResponse({"success": True, "eventId": event["clickwrapEventId"]})
    else:
        return JsonResponse({"success": False, "status": event["clickwrapEventStatus"]}, status=403)

Requests to /clickwrap/verify are counted toward billing. Implement rate limiting or a Captcha check before this step to prevent abuse from end users.

Until verification is performed, the Clickwrap Event will be visible on the ClickTerm Dashboard but will remain in an Unverified state.

If a user declines the agreement, the event is still verified but no Certificate of Acceptance is generated. It is up to your application to decide how to handle this (e.g., blocking the user journey, restricting features, or allowing continued access).

Next steps

Download certificates

Retrieve the Certificate of Acceptance PDF.

Check consent status

Query whether an end user has accepted the latest version.

API reference

Full request/response details for the verify endpoint.

Getting started

Integration guides

Web SDK

Android SDK

React Native SDK

Resources

Verifying a Signature

Endpoint

Request

Request body

Response

Framework examples

Next steps

Download certificates

Check consent status

API reference

​Endpoint

​Request

​Request body

​Response

​Framework examples

​Next steps

Download certificates

Check consent status

API reference

Endpoint

Request

Request body

Response

Framework examples

Next steps