Add e-signing to your product
Start signing requests from your backend and hand each signer a branded link on your own subdomain — or embed the signing view straight into your page. No wesign.now account for them, either way. The REST API comes with the Enterprise plan.
One POST to /v1/signing-requests with the PDF (bytes or a URL), the signers and a placement mode. Fields land at call time — anchors in your PDF, explicit coordinates, or an appended signature page.
The response carries a signingUrl per signer on yourco.wesign.now. Open it in a new tab or redirect to it — no login, no wesign.now account. Ask for an SMS code per signer when you need advanced (AES) assurance.
A signed webhook fires as each signer completes and again when the document is done, carrying a key-authenticated URL to the sealed PDF (PAdES-B) and the audit trail. Or poll GET /v1/documents/{id}.
POST https://api.wesign.now/v1/signing-requests
Authorization: Bearer wsk_live_…
Content-Type: application/json
{
"file_url": "https://files.acme.com/msa.pdf",
"placement": "anchors",
"signers": [
{ "role": "customer", "email": "ann@acme.com", "name": "Ann Example",
"phone_e164": "+41791234567", "require_sms_verification": true },
{ "role": "legal", "email": "legal@acme.com" }
],
"callback_url": "https://app.acme.com/wesign/callback"
}
→ 201 {
"documentId": "8a1e4f9a-…",
"status": "pending",
"signers": [
{ "role": "customer", "email": "ann@acme.com", "status": "pending",
"signingUrl": "https://acme.wesign.now/en/sign/7b1c…", "signingRequestId": "…" },
{ "role": "legal", "email": "legal@acme.com", "status": "pending",
"signingUrl": "https://acme.wesign.now/en/sign/9d2e…", "signingRequestId": "…" }
],
"callback": { "url": "https://app.acme.com/wesign/callback", "secret": "whsec_…" }
}Everything you need to ship it
Signers are guests, keyed by email. They open the link, sign, and are done — they never sign up for wesign.now.
Signing runs on yourco.wesign.now with your logo, colours and reply-to address. It looks like your product, not ours.
Your user, their counterparty, or both — up to 20 signers per request, in parallel or in a fixed order, each with their own link.
Set require_sms_verification and a phone number per signer. They confirm a one-time code before they sign (or before the document opens, with sms_gate: before_view); the check lands on the audit trail and the signature is classed as advanced (AES).
A PAdES-B seal on every signed PDF, eIDAS- and ZertES-admissible, an RFC 3161 time stamp over the signed file kept with our records and on the audit certificate, plus an audit-trail PDF you can download by API. Every signature’s assurance level is recorded and verifiable.
HMAC-signed events for each signature and for completion, with a key-authenticated URL to the sealed PDF. Verify the signature, fetch the file, store it.
Sign inside your own page
Your backend exchanges a signing request for a short-lived session and gets back a URL you drop into an iframe or a mobile webview. The frame shows the document, that signer's fields and the signing action — nothing else: no account, no navigation, no wesign.now chrome. Your accent colour, your font, your logo.
- A short-lived, single-signer session minted server-side with your API key: one signing request, one document, minutes — never an API key in the browser.
- One ancestor origin per session — your backend names the page that will frame the view, and the frame answers with a frame-ancestors policy for that origin alone. Restrict a key to a list of origins for a second lock.
- Theming and locale passed at mint time — accent, font, logo, corner radius — and none of our own brand chrome inside the frame.
- A versioned postMessage schema (ready, viewed, signed, declined, expired, error) so your page can advance the case immediately, while the webhook stays the source of truth.
POST https://api.wesign.now/v1/embedded/sign-sessions
Authorization: Bearer wsk_live_…
{ "signing_request_id": "3f1c9e2a-…",
"origin": "https://portal.example.com",
"ttl_seconds": 300, "locale": "de" }
→ 201 { "embed_url": "https://acme.wesign.now/de/embed/sign/b7c2…",
"expires_at": "…" }The exact contract — minting, the CSP directives to publish, the postMessage schema, theming, token lifetime and revocation — is on the embedded signing docs page, with a copy-pasteable host page to start from.
Add legally-sound signing to your product
The hosted flow ships on every plan that includes the REST API. In-page signing — embed sessions, per-session origins and postMessage events — is an Enterprise capability; talk to us and we'll set your workspace up.