Signatures from your own software

Quickstart

1. Create an API key under Integrations. Start with a test key: it behaves exactly like a live one but sends no e-mail.
2. POST a PDF and the signers. The response carries one secure signing link per signer.
3. Register a webhook (or poll the status endpoint) and download the sealed PDF and its certificate when the document is finalized.

curl -X POST https://sealique.com/api/v1/documents \
  -H "Authorization: Bearer af_test_…" \
  -H "Idempotency-Key: order-1042" \
  -F "file=@contract.pdf" \
  -F "title=Service agreement" \
  -F 'signers=[{"name":"Aline Uwase","email":"aline@example.com","title":"CEO"},
               {"name":"Eric Mugisha","email":"eric@example.com"}]' \
  -F "signing_order=sequential" \
  -F "return_url=https://app.example.com/signed"

import requests

r = requests.post(
    "https://sealique.com/api/v1/documents",
    headers={"Authorization": "Bearer af_test_…", "Idempotency-Key": "order-1042"},
    files={"file": open("contract.pdf", "rb")},
    data={
        "title": "Service agreement",
        "signers": '[{"name": "Aline Uwase", "email": "aline@example.com", "title": "CEO"}]',
        "signing_order": "sequential",
        "return_url": "https://app.example.com/signed",
    },
    timeout=30,
)
doc = r.json()
print(doc["status"], doc["signing_links"][0]["signing_url"])

import { readFile } from "node:fs/promises";

const form = new FormData();
form.append("file", new Blob([await readFile("contract.pdf")], { type: "application/pdf" }), "contract.pdf");
form.append("title", "Service agreement");
form.append("signers", JSON.stringify([{ name: "Aline Uwase", email: "aline@example.com", title: "CEO" }]));
form.append("signing_order", "sequential");

const res = await fetch("https://sealique.com/api/v1/documents", {
  method: "POST",
  headers: { Authorization: "Bearer af_test_…", "Idempotency-Key": "order-1042" },
  body: form,
});
const doc = await res.json();
console.log(doc.status, doc.signing_links[0].signing_url);

Prefer JSON? Send Content-Type: application/json with file_base64 instead of the multipart file; every other option is the same.

{
  "id": "6f1c…", "status": "sent", "mode": "test", "title": "Service agreement",
  "signing_order": "sequential", "auto_finalize": true,
  "signers": [{"id": "…", "name": "Aline Uwase", "email": "aline@example.com", "status": "invited",
               "signing_url": "https://sealique.com/sign/…", "link_expires_at": "2026-11-08T10:00:00+00:00"}],
  "signing_links": [{"id": "…", "name": "Aline Uwase", "email": "aline@example.com",
                     "signing_url": "https://sealique.com/sign/…", "expires_at": "…"}],
  "verification_id": null, "verify_url": null, "document_hash": null, "finalized_at": null,
  "certificate_url": null, "file_url": null, "metadata": {}, "events": [ … ]
}

Authentication, modes and scopes

Every key-authenticated request carries Authorization: Bearer <key>. Keys are shown once, at creation, and can be revoked at any time.

Document lifecycle

Side exits: declined when a signer refuses, canceled when you call cancel. With auto_finalize (the default) the step from completed to finalized happens by itself; otherwise call POST …/finalize.

Sealing stamps every signature into the PDF, applies the platform certification signature and one PAdES signature per signer, then hashes the file (SHA-256) and issues a verification ID printed in every signature block. The certificate of completion is a separate PDF.

Errors

Every error has the same shape and an HTTP status that matches:

{"error": {"code": "invalid_state", "message": "The document can be finalized once every signer has signed.", "status": 409}, "mode": "live"}

Webhooks

Register an https URL and we POST a JSON event whenever one of your documents changes. Live documents reach live endpoints, sandbox documents reach test endpoints. An endpoint takes the mode of the key that registers it, so a test key only manages test endpoints. The host must be public: URLs pointing at private, loopback or link-local addresses are rejected.

{
  "id": "delivery-uuid", "event": "signer.signed", "created_at": "2026-10-09T10:12:00+00:00", "mode": "live",
  "data": {
    "document": { "id": "…", "status": "sent", "signers": [ … ], "metadata": {"order": 1042}, … },
    "signer": { "id": "…", "name": "Aline Uwase", "email": "aline@example.com", "status": "signed", "signed_at": "…" }
  }
}

Verify the signature

import hmac, hashlib, time

def verify(secret: str, header: str, body: bytes, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = int(parts["t"]), parts["v1"]
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

# Flask / FastAPI / Django: pass the raw request body, not a re-serialised dict
ok = verify(WEBHOOK_SECRET, request.headers["X-Sealique-Signature"], request.get_data())

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret, header, rawBody, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (Math.abs(Date.now() / 1000 - t) > tolerance) return false;
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}
// express: app.post("/hooks", express.raw({ type: "application/json" }), (req, res) => { verify(SECRET, req.get("X-Sealique-Signature"), req.body) … })

Embedding the signing experience

window.addEventListener("message", (e) => {
  if (e.origin !== "https://sealique.com") return;
  if (e.data?.type === "sealique" && e.data.event === "signed") {
    // e.data.document, e.data.signer
  }
});

Identity confirmation: set require_otp and each signer must enter a one-time code e-mailed to them before the document opens. Every signer also accepts explicit consent statements; both are recorded in the audit trail and the certificate.

Verification

Three public, key-less ways to check a document. All are rate limited per IP (20 per minute).

# by file: authentic | modified_after_sealing | tampered | flattened_copy | unsigned_unknown | …
curl -F "file=@signed.pdf" https://sealique.com/api/v1/verify
# by verification ID (printed on every page)
curl https://sealique.com/api/v1/verify/VF-3F9A1C-7B2D0E
# one page's fingerprint (the QR in a page mark)
curl https://sealique.com/api/v1/verify/VF-3F9A1C-7B2D0E/page/3/1a2b3c4d

result = requests.post("https://sealique.com/api/v1/verify", files={"file": open("signed.pdf", "rb")}, timeout=60).json()
print(result["code"], result.get("verification_id"), result["match"])

const form = new FormData();
form.append("file", new Blob([await readFile("signed.pdf")]), "signed.pdf");
const result = await (await fetch("https://sealique.com/api/v1/verify", { method: "POST", body: form })).json();
console.log(result.code, result.verification_id, result.match);

Outcome codes: authentic (byte-identical to the sealed file), modified_after_sealing (signatures intact but the file changed, e.g. annotations), tampered (a signature no longer validates), flattened_copy (a print or scan of a sealed document; text compared page by page), unsigned_unknown, unparseable, foreign_root, not_found, too_large.

Rate limits and idempotency

• Per key: 120 requests per minute. Over it you get 429 rate_limited with a Retry-After header (seconds).
• Verification endpoints: 20 per minute per IP.
• Send an Idempotency-Key header (up to 128 characters, unique per key) with POST /api/v1/documents. A retry with the same key replays the first response (Idempotent-Replayed: true) instead of creating a second document.
• Lists are cursor-paginated: limit (1–100, default 25) and next_cursor from the previous page.
• PDFs up to 30 MB; metadata up to 8 KB; signing links valid 30 days.