Electronic Signature API: sign documents legally via API

If you build software, you eventually hit the same wall: a contract, a quote or an HR form needs a real, legally valid signature — and emailing a PDF back and forth is not it. An electronic signature API lets you embed signing directly into your own app or workflow, so users never leave your product. This guide shows what the Sign API by Layerone offers, how it works, and how to send your first document for signature in a few lines of code.

The need: embed signing into your app or workflow

Most teams don't want yet another signing portal. They want signing to happen inside the tools they already use: a CRM that sends a sales contract the moment a deal is won, an HR platform that pushes an employment agreement to a new hire, a billing system that requires a signed quote before work begins. A developer-first eSignature API turns signing into a programmable step you can trigger automatically, track, and audit — no manual handling, no copy-paste, no lost paperwork.

The Sign API is built for exactly this. You send a PDF and a list of signers over HTTPS, your signers receive a secure link, and you get the signed document plus its legal proof back. Everything is driven by simple JSON requests authenticated with an X-API-Key header.

What the Sign API offers

Sign is not a "draw your name on the screen" gimmick. It produces a signature that holds up as evidence under European law and follows recognised technical standards.

• eIDAS advanced electronic signature: compliant with EU Regulation 910/2014, Article 26, the level of signature expected for contracts, sales and HR documents across the EU.
• PAdES-B-LTA: signatures follow the ETSI EN 319 142 standard for long-term validation, so the signed PDF stays verifiable for years, even after certificates expire.
• SMS OTP before signing: each signer confirms identity with a one-time code sent to their phone, reinforcing the legal strength of the signature.
• Proof certificate embedded in the PDF: a tamper-evident record of who signed, when, and how, sealed inside the document with RSA-4096 PKI.
• Admissible as evidence: the combination of identity verification, cryptographic sealing and a full audit trail makes the signature legally admissible in court.

Because the proof travels inside the PDF, you don't have to store a separate evidence file or trust a third-party dashboard to prove a signature later. The document is self-contained.

Why the level of signature matters

Under the eIDAS regulation, electronic signatures come in three levels: simple, advanced and qualified. A simple signature is just a scanned image or a checkbox — easy to contest. A qualified signature requires a certified device and a face-to-face or video identity check, which is heavy and expensive for everyday business. The advanced electronic signature sits in the sweet spot: it uniquely links the signature to the signer, lets you detect any later change to the document, and is created with means the signer keeps under their sole control. That is the level most contracts, quotes and HR documents need, and it is exactly what the Sign API delivers out of the box.

Two pieces of the Sign API do the heavy lifting here. The SMS OTP ties the act of signing to a specific person's phone, which is the practical identity link required for an advanced signature. The PAdES-B-LTA cryptographic seal, built on RSA-4096 keys, makes any tampering detectable and keeps the signature verifiable in the long term. Together they turn a PDF into a piece of evidence you can rely on if a deal is ever disputed.

How it works

The flow has three steps: send a document, check its status, download the signed file. A full audit trail is always available, and you can add an explicit SMS OTP step when you need it.

1. Send a PDF and your signers

Send a JSON request to POST https://sign.layerone.fr/v1/documents/send with the document and a signers array. Each signer carries a name, email, role and phone number (used for the SMS OTP).

curl -X POST https://sign.layerone.fr/v1/documents/send \
  -H "X-API-Key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "document": {
      "name": "Sales contract",
      "file_url": "https://yourapp.com/files/contract.pdf"
    },
    "signers": [
      {
        "name": "Jane Doe",
        "email": "[email protected]",
        "role": "Client",
        "phone": "+33612345678"
      }
    ]
  }'

The response returns a document_id you keep to track the rest of the process.

2. Check the status

Poll GET https://sign.layerone.fr/v1/documents/{id} to know where the document stands: pending, signed, or refused. For a complete, court-ready history of every action, call GET /v1/documents/{id}/audit.

curl https://sign.layerone.fr/v1/documents/doc_123 \
  -H "X-API-Key: your_api_key"

3. Download the signed PDF

Once every signer has completed the process, retrieve the finished file — with its proof certificate embedded — from GET https://sign.layerone.fr/v1/documents/{id}/download.

curl https://sign.layerone.fr/v1/documents/doc_123/download \
  -H "X-API-Key: your_api_key" \
  -o signed-contract.pdf

Optional: trigger SMS OTP explicitly

When your workflow needs a separate identity step, request a one-time code with POST /v1/otp/request and validate it with POST /v1/otp/verify before the signature is recorded.

Use cases

Any document that needs a binding signature can be automated with the Sign API:

• Contracts: service agreements, NDAs, partnership and supplier contracts signed straight from your platform.
• Sales: quotes and order forms signed the moment a prospect says yes — no friction, no delay between decision and commitment.
• HR: employment contracts, amendments and onboarding paperwork sent and signed automatically when a new hire is created.

Because signing is just an API call, you can wire it into approval flows, trigger it from webhooks, or fan it out across many documents at once. A typical pattern pairs the Sign API with a document generator: you build the contract or quote on the fly with the PDF generation API, then pass the resulting PDF straight to the Sign API for signature — the whole "create, send, sign, archive" loop runs without a human ever touching a file.

Frequently asked questions

Is a signature created through the API legally binding?

Yes. The Sign API produces an eIDAS advanced electronic signature (EU Regulation 910/2014, Article 26), backed by SMS OTP identity verification and a PAdES-B-LTA cryptographic seal. Combined with the embedded proof certificate and audit trail, the signed document is admissible as evidence in court across the European Union.

Do my signers need an account or any software?

No. Signers receive a secure link by email, confirm their identity with a one-time SMS code, and sign in the browser. There is nothing to install and no account to create on their side.

What format do I send to the API?

The Sign API works with JSON request bodies. You send the document and a signers array — each entry holding a name, email, role and phone number — and you receive JSON responses with the document status and download links.

How do I prove a signature later?

The proof certificate is embedded directly inside the signed PDF, and a full audit trail is available at GET /v1/documents/{id}/audit. You don't depend on an external portal staying online to demonstrate who signed what, and when.

Start for free and connect anywhere

The Sign API includes a free tier of 20 documents per month, so you can integrate and test in production conditions before committing to a paid plan. Create your developer account and grab your API key on the developer console at dev.layerone.fr.

Beyond raw HTTP, Sign ships with ready-made connectors so you can integrate it from almost any stack or no-code tool: npm, MCP, Zapier, Make, n8n, Pipedream, Bubble, Adalo and Postman. Whether you write code or build visually, you can add legal signatures to your workflow in minutes.

Related articles