API documentation

Send a PDF or a filled template for signature over one REST API. The wesign.now API reference, guides, errors and support.

The whole signing flow — anchors, signers, dispatch, signed PDF, audit trail, webhooks — sits behind one REST API at https://api.wesign.now/v1, authenticated with a Bearer API key. No templates required, no portal redirect for the recipient, no SDK to install.

https://api.letssign.now/v1 is a permanent alias of the same API. The Base URL section says exactly what is — and what isn't — the contract.

Three steps to ship

Mint an API key

Go to Developers → API keys in your workspace and click Create API key. Copy the wsk_live_… token — we only display the plaintext once. Keys minted before the September 2026 rename start with lsk_live_ and keep working unchanged. API keys come with Enterprise (and legacy Teams) workspaces; GET /v1/me checks a key and reports what its workspace may use.

Send your first signing request

Replace YOUR_KEY and run this in a terminal:

curl -X POST https://api.wesign.now/v1/signing-requests \
  -H "Authorization: Bearer YOUR_KEY" \
  -F "file=@contract.pdf" \
  -F 'signers=[{"email":"signer@example.com","role":"signer"}]'

Every key is live — there is no sandbox yet — so this sends a real invitation: put an address you own, and see Testing without a sandbox.

Drop [[ls:signature:signer]] anywhere in your PDF and we place a signature field there. No marker? We auto-append a signature page. Need the signer to confirm an SMS code before they can sign? Add phone_e164 and require_sms_verification to the signer — see Second factor by SMS, and SMS verification for the whole flow.

(Optional) Receive real-time events

Register a receiver once with POST /v1/hooks (or at Developers → Webhooks, or per request with callback_url). Send "payload": "minimal" for identifiers only, without personal data. We POST signing_request.signed as each signer completes, and document.completed with key-authenticated URLs of the signed PDF and the audit trail when everyone's done. Every delivery is HMAC-signed (X-WeSign-Signature) — verify it before trusting the body — and POST /v1/hooks/{id}/test sends a signed ping to check your endpoint.

Sending contracts you author once in the app? The Template quickstart goes from a template to a sealed PDF: a one-signer rich-text letter, or a PDF two people sign in order. An app that asks its users for the values first follows Prepare a fill in your app: read the template's contract, ask, dry-run with validate_only, then send.

What's in this site

Quickstart

Your own PDF to a sealed, signed PDF in five minutes, terminal only.

Template quickstart

Author a template in the app, fill it over the API, follow two signers in order, download the result.

API overview

Base URL and its alias, versioning, the map of v1 resources.

OpenAPI spec

The machine-readable contract — import it into Postman, Insomnia or a client generator.

Authentication

Bearer keys, key format, rotation, error shape.

Create a signing request

The big endpoint. Multipart or JSON, signers, placement, SMS second factor. Read one signer, remind, withdraw.

Placement modes

Anchors, auto-append, or explicit coordinates — and why manual placement is retired.

Documents

GET a document and its signers, signed-PDF download, audit-trail PDF.

Templates

Instantiate a locked template with field_values; stage for review first.

Prepare a fill in your app

Read a template's contract, ask your user for what it needs, dry-run, then send.

Webhooks

Events we emit, signature verification in Node and PHP, retry semantics.

Idempotency

Safely retry network blips without double-sending.

Rate limits

60 requests/minute per API key. Retry-After on 429.

Errors

Stable error codes mapped to HTTP statuses.

Security

Encryption at rest and in transit, signature evidence, webhook signing.

How verification works

Hash lookup, PAdES validation, eIDAS QES detection, trust scope.

For AI assistants

Building the integration with an AI assistant or coding agent? Give it these instead of pasted pages. The two text files are generated from this site's source on every deploy, so they always match the pages.

Tell your assistant three things: there is no sandbox (every key is live and sends real email and SMS; test with validate_only, review: true and send_emails: false); the exact shapes are in the OpenAPI spec; there is no SDK and no MCP server, so it generates a client from the spec or calls the REST API directly.