Electronic signature API guide

An e-signature integration is four moving parts: get a document in, describe the fields, ask for signatures, and react when something happens. This guide walks that shape using the Sign10X API, but the sequence applies to most platforms.

1. Authentication

Create an API key in your workspace and send it as a bearer token. The secret is shown once and stored hashed, so keep it in your server-side secret manager — never in browser code or a mobile bundle. Test and production keys are separate, so build against test first.

2. Create the document

Upload the PDF you want signed. The API returns a document ID that every later call refers to. Sign10X analyses the pages deterministically and reports the fields it detected, which you can accept as-is or ignore in favour of your own coordinates.

3. Describe the fields

Fields use normalized coordinates — page number plus x, y, width and height expressed as fractions of the page — so placement is resolution independent and survives different render sizes. Each field has a type (signature, initial, date, name, email, text, checkbox), a recipient assignment, and a required flag.

If the same contract shape recurs, prepare it once as a template instead and let the template carry the field layout. Your integration then only supplies data and recipients.

4. Send the signature request

curl https://sign10x.com/api/public/v1/signature-requests \
  -H "Authorization: Bearer $SIGN10X_API_KEY" \
  -H "Idempotency-Key: order-4821-contract" \
  -H "Content-Type: application/json" \
  -d '{
    "document_id": "doc_...",
    "recipients": [
      { "name": "Dana Reed", "email": "[email protected]", "role": "signer" }
    ]
  }'

Two headers matter for reliability. Idempotency-Key makes a retry safe — if your job runs twice, you get the original request back instead of a duplicate envelope. The response also carries a request ID; log it, because it is the fastest way to trace a specific call later.

5. React to events with webhooks

Polling for status works, but webhooks are better. Register an endpoint, verify the signature on every delivery before you trust the payload, and respond quickly with a 2xx — do the real work in a background job. Sign10X retries failed deliveries and keeps a delivery history you can inspect.

Treat webhooks as notifications, not as your source of truth. When an event arrives, fetch the current state of the request before making an irreversible decision, since deliveries can arrive out of order or more than once.

6. Collect the completed document

On completion, request the signed PDF. Downloads are served through short-lived links rather than permanent URLs, so fetch and store the file in your own system if you need long-term access, and keep the audit trail with it.

Practical notes

• Handle rate limits by backing off on 429 responses rather than retrying immediately.
• Validate recipient email addresses before sending — bounces are the top failure cause.
• Store your document and request IDs against your own records so support questions are answerable.
• Never expose an API key to a browser; mint short-lived sessions server-side instead.

Ready to write code? Use the JavaScript, Python and PHP integration guide, or explore calls first in the sandbox console. API access is included on every paid Sign10X plan.