Integrating electronic signature in 20 minutes
Discover how to integrate an electronic signature API in less than 20 minutes: creating a request, sending the link, receiving the signed webhook, and retrieving the signed PDF.
Integrating electronic signature into your application does not require weeks of development. With a well-designed API, you can offer signing in just a few minutes. This tutorial shows you step by step how to create a signature request, send the link to the signer, receive a signed notification, and retrieve the signed document, using Sign-Hub. We will also cover the essential security and compliance aspects.
Why integrate electronic signature?
Electronic signature has become a standard for contracts, quotes, or any document requiring validation. Integrating it into your application avoids the back-and-forth of printing, scanning, and postal mailing. For a developer, this means automating a business process and offering a smooth experience to the end user.
Overview of the Sign-Hub API
Sign-Hub is an electronic signature service published by NEW VISION OF APPS (SAS, Janzé, France). It positions itself as an API-first solution: all features are accessible via a REST API. A single route allows you to create a signature request. The service then handles sending emails, tracking signatures, and generating evidence documents.
The API is documented according to the OpenAPI 3.1 specification. A TypeScript SDK is available to facilitate integration. In addition, an llms.txt file is designed to be read by a code assistant, which speeds up development.
Prerequisites
- A Sign-Hub account (free Découverte plan, 10 transactions per month)
- An API key (available in the dashboard)
- A development environment (Node.js for this tutorial)
Step 1: Create a signature request
The first step is to call the API to create a request. You must provide the document to be signed (PDF), the signer's identifier (email, name), and optionally options such as the signing order.
Example request with curl:
curl -X POST "https://api.sign-hub.example.com/v1/signature-requests" \
-H "Authorization: Bearer VOTRE_CLE_API" \
-H "Content-Type: application/json" \
-d '{
"document": {"name": "contrat.pdf", "content": "base64..."},
"signers": [
{"email": "client@example.com", "first_name": "Jean", "last_name": "Dupont"}
]
}'
The response contains a request identifier and a public signing link. This link is unique to each signer. You can send it by email or display it in your interface.
Step 2: Send the link to the signer
The public link can be included in an automatic email or displayed on a page of your application. Sign-Hub also handles sending reminder emails if you configure it. In our example, we send the link directly via the API of your choice.
Step 3: Receive the signed webhook
When the signer has completed their signature, Sign-Hub sends a notification to your server via a webhook. This webhook is signed with an HMAC secret to guarantee its authenticity. Two versions are offered: a simple one and a timestamped anti-replay one.
To verify the webhook, you must calculate the HMAC signature from the request body and compare it with the provided header. If it fails, ignore the request.
Example verification in Node.js:
const crypto = require('crypto');
function verifyWebhook(payload, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return expected === signature;
}
Step 4: Retrieve the signed PDF and the evidence file
After the webhook, you can retrieve the signed PDF and the evidence file via the API. The PDF is sealed in PAdES format, guaranteeing its integrity. The evidence file contains all the information needed to verify the validity of the signature.
Example retrieval:
curl -X GET "https://api.sign-hub.example.com/v1/signature-requests/{id}/signed-pdf" \
-H "Authorization: Bearer VOTRE_CLE_API"
Verifiable proof: a differentiating asset
Unlike many players, Sign-Hub allows anyone to verify the validity of a signature without trusting the publisher. The evidence file is signed with an Ed25519 key, whose public key is published at a well-known address. You can verify a proof.json offline or via an online tool. This transparency strengthens the probative value.
Security and compliance
Sign-Hub complies with the eIDAS regulation (Regulation (EU) No 910/2014) for simple electronic signature. The signer's consent is explicitly recorded, the document fingerprint is fixed at the time of signing, and connection data is anonymized in accordance with the RGPD, without breaking the proof. Data is hosted in the European Union.
It is important to note that the proposed signature is a simple electronic signature, reinforced by email verification and sealing. It does not constitute an advanced or qualified signature within the meaning of eIDAS. For acts where the law requires a qualified signature, other solutions such as Universign may be necessary.
Comparison with other solutions
Yousign, DocuSign, and Universign also offer electronic signature APIs. Most offer similar features: sending links, tracking, webhooks. Sign-Hub stands out for its transparency on proof verification and its API-first approach with documentation designed for AI. Its per-transaction pricing, with no mandatory subscription, can suit small organizations.
Going further
The TypeScript SDK allows you to quickly integrate the API into your projects. The OpenAPI 3.1 specification is available, and the llms.txt file can be used by code assistants to generate integration code. To test, create an account on the Découverte plan and use your first API key.
Conclusion
Integrating electronic signature into your application is within reach of any developer, and Sign-Hub makes it simple and fast. In less than 20 minutes, you can create a request, receive the webhook, and retrieve the signed document. The complete documentation and provided tools will allow you to go further according to your needs.