Quickstart

This walks through the full signing loop with the REST API: create a document, send it, and receive a document.completed webhook when it is signed and sealed.

The staging base URL is https://web.esign.codeless.au/api/v1.

1. Create an API key

Sign in to the web app, open Settings → API tokens, and create a key. The full key (esk_live_… in production, esk_test_… elsewhere) is shown once — copy it. Send it as a bearer token on every request. See Authentication.

2. Register a webhook

curl -X POST https://web.esign.codeless.au/api/v1/webhooks \
  -H "Authorization: Bearer $ESIGN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/esign",
    "events": ["document.completed"]
  }'

The response includes a secret (shown once) used to verify delivery signatures — see Webhooks.

3. Create a document

Submit the PDF (base64-encoded) together with recipients and their fields in one call. The response returns the new document id.

curl -X POST https://web.esign.codeless.au/api/v1/documents \
  -H "Authorization: Bearer $ESIGN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "title": "NDA",
    "fileName": "nda.pdf",
    "file": "<BASE64_PDF>",
    "recipients": [
      {
        "email": "signer@example.com",
        "name": "Alex Signer",
        "role": "signer",
        "fields": [
          { "type": "signature", "page": 1, "x": 10, "y": 80, "width": 30, "height": 8 }
        ]
      }
    ]
  }'

Field coordinates are percentages of the page (origin top-left).

4. Send for signature

curl -X POST https://web.esign.codeless.au/api/v1/documents/$DOCUMENT_ID/send \
  -H "Authorization: Bearer $ESIGN_API_KEY"

Each recipient receives an email with a secure link and signs from any device — no account required. This emits a document.sent event.

5. Receive the completed event

When every signer is done, ESign seals the PDF (PAdES digital signature + audit certificate page) and delivers a document.completed webhook to your endpoint. Verify the signature, then fetch the sealed file. Reminders and expiry are handled automatically.

Prefer the UI? Everything above is also available in the web app.