Digital signing for every workflow.

# Seal data with the company key (CAdES, detached)
curl -X POST https://signing.your-domain.com/sign/data \
  -H "Authorization: $SIGNLAYER_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "signer": { "type": "hsm" },
        "input":  { "data": "SGVsbG8gV29ybGQ=" },
        "output": { "format": "cades", "mode": "detached" } }'

# Verify it
curl -X POST https://signing.your-domain.com/verify \
  -H "Authorization: $SIGNLAYER_API_TOKEN" -d @verify.json

// Call from your backend. Never ship the API token to browsers or apps.
const res = await fetch(`${SIGNLAYER_URL}/sign/data`, {
  method: 'POST',
  headers: {
    Authorization: process.env.SIGNLAYER_API_TOKEN,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    signer: { type: 'hsm' },
    input: { data: Buffer.from(invoiceXml).toString('base64') },
    output: { format: 'cades', mode: 'detached' }
  })
});
const { statusCode, error, result } = await res.json();

# Validate every signature in a PDF
import base64, os, requests

with open("contract-signed.pdf", "rb") as f:
    pdf = base64.b64encode(f.read()).decode()

r = requests.post(
    f"{os.environ['SIGNLAYER_URL']}/documents/pdf/validate",
    headers={"Authorization": os.environ["SIGNLAYER_API_TOKEN"]},
    json={"file": pdf},
)
print(r.json()["result"])