Docs

Browser signing with smart cards

People sign with their own smart card or USB token, in your web app. The private key never leaves the token.

How it works

  1. The person installs the Trpass / Tawqe3y desktop app (Windows, macOS or Linux). It runs in the tray and listens only on the local machine, on a secure local WebSocket.
  2. Your page connects to the desktop app with the Browser SDK, lists the certificates on the token and lets the person choose one.
  3. Your backend calls the Signing API to prepare the document: POST /documents/pdf/prepare for PDFs, or POST /sign/data with signer.type = "token" for files and data. It returns an ID and the value to sign.
  4. The desktop app asks for the token PIN and signs that value on the token.
  5. Your backend completes the signature: POST /documents/pdf/finish or POST /sign/finish, with the ID, the certificate and the signature. You get the signed PDF (PAdES) or CMS/CAdES signature.

What you need

  • The Browser SDK package (ask your SignLayer contact).
  • Your domain on the desktop app allow-list.
  • A backend route that proxies prepare and finish calls to the Signing API.

Supported tokens

Smart cards and USB tokens with qualified certificates from licensed Egyptian CAs, accessed through the token vendor's PKCS#11 driver. Ask us about a specific token model.