How do I add e-signatures to my own software with the Sealique API?
Create a document with one POST to /api/v1/documents, let signers sign from the returned links, receive HMAC-signed webhooks and fetch the sealed PDF with its PAdES digital signature.
The Sealique API is a plain REST API under /api/v1 with an OpenAPI 3.1 description, bearer keys in test and live mode, idempotency keys, per-key rate limits and webhooks signed with HMAC. The verification endpoints need no key at all, so any system can check a sealed PDF. This page is the overview; the full reference with every request and response lives in the developer docs.
Read the developer docs Verify a signed document
Key facts
- One request creates a document and sends it: POST /api/v1/documents with the PDF, the signers and the signing order returns the document and a personal signing link per signer.
- Keys come in test and live mode (af_test_… and af_live_…) with scopes documents:read, documents:write, verify and webhooks; the default allowance is 120 requests per minute per key.
- Webhooks deliver document.sent, signer.opened, signer.signed, signer.declined, document.completed, document.finalized and document.canceled, each signed with an HMAC header and retried on failure.
- GET /api/v1/verify/{verification_id} and POST /api/v1/verify (upload) are public: no key, limited to 20 requests per minute per IP.
- The sealed PDF and the certificate of completion are fetched with GET /api/v1/documents/{id}/file and /certificate; the signing page can be embedded in your own site through allowed origins.
How do I send a PDF for signature from code?
Create an API key under Integrations, then call POST /api/v1/documents as multipart (file, title, signers as a JSON string, signing_order) or as JSON with file_base64. Add an Idempotency-Key header so a retry never creates two documents. The response contains the document id, its status and signing_links, one per signer. Signers open the link, accept the consent statements and sign; with auto_finalize (the default) the document is sealed as soon as the last signer has signed.
curl example: curl -X POST https://your-host/api/v1/documents -H "Authorization: Bearer af_test_…" -H "Idempotency-Key: order-1042" -F "file=@contract.pdf" -F "title=Service agreement" -F 'signers=[{"name":"Aline Uwase","email":"aline@example.com"}]' -F "signing_order=sequential"
Python example: requests.post(base + "/api/v1/documents", headers={"Authorization": "Bearer af_test_…"}, files={"file": open("contract.pdf", "rb")}, data={"title": "Service agreement", "signers": '[{"name": "Aline Uwase", "email": "aline@example.com"}]'}).json()
JavaScript example: const form = new FormData(); form.append("file", pdfBlob, "contract.pdf"); form.append("title", "Service agreement"); form.append("signers", JSON.stringify([{ name: "Aline Uwase", email: "aline@example.com" }])); const doc = await (await fetch(base + "/api/v1/documents", { method: "POST", headers: { Authorization: "Bearer af_test_…" }, body: form })).json();
How do I know when a document is signed?
Register a webhook endpoint (POST /api/v1/webhooks or the Integrations page) and subscribe to the events you need. Each delivery is a JSON body with the event name and the document, signed with an HMAC over a timestamp and the body in a signature header so you can reject forged calls; failed deliveries are retried. Polling GET /api/v1/documents/{id} returns the same status, verification_id and verify_url once sealed.
How do I fetch and verify the sealed PDF?
GET /api/v1/documents/{id}/file returns the sealed PDF and /certificate the certificate of completion, both needing the documents:read scope. To verify a file from anywhere, call GET /api/v1/verify/{verification_id} or POST /api/v1/verify with the PDF; both are public and return the signers, the sealing time and an integrity code such as authentic, modified_after_sealing or flattened_copy. GET /api/v1/verify/{id}/page/{page}/{digest} checks a single page mark.
Can I embed the signing page in my application?
Yes. Set the allowed origins on the API key; the signing page then sends a Content-Security-Policy that permits your origin to frame it, and after signing it redirects to your return_url and posts a message to the parent window with the event. Signers never need an account.
What does the API cost?
Nothing today: test and live keys are included with every account, with 120 requests per minute per key by default and sandbox documents that send no e-mails. The OpenAPI description at /api/v1/openapi.json can be imported into Postman, Insomnia or a code generator.
What E-signature API includes
- REST API under /api/v1 with OpenAPI 3.1 description
- Test and live keys with scopes and expiry
- Idempotency keys and per-key rate limits
- HMAC-signed webhooks with retries
- Public verification endpoints without a key
- Embeddable signing page with return_url
Questions people ask
Does the API cost anything?
No. API keys and webhooks are included with every account today, and verification is public; a per-key rate limit of 120 requests per minute applies by default.
Can I verify a signed PDF through the API without a key?
Yes. GET /api/v1/verify/{verification_id} and POST /api/v1/verify are public, limited to 20 requests per minute per IP.
Which webhook events exist?
document.sent, signer.opened, signer.signed, signer.declined, document.completed, document.finalized and document.canceled, plus a ping for testing.
How are webhooks secured?
Each delivery carries an HMAC signature over a timestamp and the body, computed with the endpoint's secret; verify it before trusting the payload.
Endpoint URLs are checked against private network ranges before any delivery.
Is there a sandbox?
Yes. Documents created with a test key are sandbox documents: the flow is identical but no e-mails are sent to signers.