eSignature API for SaaS Customer Onboarding

Click-through terms work for self-serve sign-ups: courts generally enforce them when the terms are clearly presented and the user takes a clear action to accept. Larger deals are different. When the buyer is a company, the question is not only whether someone clicked, but whether that person could bind the company. In at least one US federal case, a click by an employee did not bind the company because the vendor had been told only named executives could sign contracts.

The API supports the signed side of this: a named signer, a recorded signing certificate and your countersignature after theirs.

1. Quote to signed order form

Your CPQ or billing system renders the order form PDF with the customer's plan, seats and price. Write signature tags into the template text, styled white so they stay invisible, set extractTags to true, and the API creates the fields. With signInOrder true, the customer signs first and your countersigner signs second.

curl --request POST \
  --url https://app.quicksigner.com/api/v1/requests \
  --header 'Authorization: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "fileName": "9be2...-order-form-acme.pdf",
    "extractTags": true,
    "signInOrder": true,
    "senderName": "YourApp",
    "emailSubject": "Your YourApp order form is ready to sign",
    "recipients": [
      { "type": "EMAIL", "email": "cfo@acme.example",   "name": "Customer Signatory" },
      { "type": "EMAIL", "email": "deals@yourapp.example", "name": "YourApp Countersigner" }
    ]
  }'

Tag syntax and the full request schema are in the API reference.

2. Signing inside your app

For a self-serve upgrade, load the customer's signUrl in an iframe on your billing page. Set hideInfoPanel on the request so the signing view fits your layout, disable_notifs in the admin's recipient options so they do not also get an email, and signedRedirectUrl to return them to a "thanks, your plan is active" page.

<iframe
  src="https://app.quicksigner.com/sign/..."
  width="100%" height="900" style="border:0"
  allow="camera; clipboard-write">
</iframe>

3. Provision on the webhook

Statuses such as REJECTED and CANCELED come from GET /requests/{requestId}, which also returns each recipient's sigStatus and signing order.

Download links are short-lived (about 2 hours for the signed PDF, 15 minutes for the certificate), so fetch both as soon as the webhook arrives and store them with the account.

Production runs on the Professional plan at $15 per user a month, plus $0.30 per sign request. The first 50 sign requests are free, once. Above 500 requests a month, ask for volume pricing.

The scenarios leave out the 50 free sign requests. A request with a customer signer and your countersigner is one request.

Can customers sign an order form without leaving my app?

Yes. Load the signer's signUrl in an iframe and set hideInfoPanel on the request. The signed PDF is the same as with email signing.

How do I activate the subscription after signing?

Listen for the REQUEST_COMPLETED webhook, which fires when the document is sealed. Activate the plan there, not on the signer's redirect, because signatures are applied asynchronously.

Can our side countersign automatically after the customer?

Set signInOrder to true and add your countersigner as the last recipient. They are asked to sign only after the customer has signed. If the countersigner is your API account itself, with a default signature and signature fields assigned, your backend can sign with POST /requests/{requestId}/sign after the customer's RECIPIENT_SIGNED webhook.

Can I send order forms generated by our billing system?

Yes. Upload the generated PDF and set extractTags to true to create fields from tags in the document text. You can also use a saved template by templateId.

Do customers need a QuickSigner account?

No. Signers need only a link and a browser.

Can the signing email show our company name?

Yes. senderName is shown to the signer under "Sent by" and in the notification email, and emailSubject and emailMessage set the subject and the message.

Does a DPA need a signature?

GDPR Article 28(9) requires the processing contract to be in writing, which includes electronic form. The prevailing view, shared by the Bavarian data protection authority, is that a qualified electronic signature is not required. Many enterprise customers still ask for a signed DPA so the record shows who signed it for them.

Can I test before paying?

Yes. A free developer account allows unlimited test sign requests. Completed test documents are watermarked.

• eSignature API overview
• API reference
• Developer guide on GitHub
• eSignature API for real estate
• eSignature API for property management
• eSignature API for HR onboarding and staffing
• eSignature API for insurance
• eSignature API for lending
• Free contract templates