Embedded signing guide

Embedded signing means the signing screen appears inside your own application instead of the signer opening an emailed link on the vendor's site. It is the right choice when signing is one step in a flow the user is already in — checkout, onboarding, a loan application, a booking confirmation.

When to embed and when to email

• Embed when the signer is logged into your product right now and abandoning the flow would cost you the conversion.
• Email a link when the signer is external, may sign later, or is one of several parties signing in sequence over days.

Many products use both: embed for the customer, email for the counterparty.

How an embedded session works

1. Your server creates the document and signature request through the Sign10X API, exactly as it would for an email send.
2. Your server requests an embedded signing session for one specific recipient. The response is a short-lived, single-purpose URL.
3. Your page renders that URL — typically in a frame sized for the document — and the signer completes their fields without leaving your app.
4. When they finish, you learn about it from your webhook endpoint and can advance your own flow.

Rules that keep it secure

• Mint sessions on your server only. An API key must never reach the browser, and a session URL should be handed to exactly the user you authenticated.
• Treat the session URL as a credential: do not log it, put it in analytics, or include it in a shareable link.
• Sessions are short-lived and single-use. If a user reloads long after you minted one, mint a new session rather than caching the old URL.
• Confirm completion server-side through the webhook or a status call — never from a client-side message alone.

Getting the experience right

Give the frame real height; a document squeezed into 400 pixels is where mobile signing goes wrong. Show your own progress indicator around it so the signer understands where they are in your flow, and keep a fallback: if the frame cannot load, offer to email the signing link instead. Test on a phone in both orientations before you ship.

What the signer still gets

Embedding changes the container, not the record. Consent is still captured, required fields are still enforced, and the same timestamped audit trail and completed PDF are produced — see how Sign10X stores and isolates documents.

Embedded signing is included with API access on every paid Sign10X plan. The integration guide shows the calls in JavaScript, Python and PHP.