API documentation
Send any PDF for signing with a single POST. The letssign.now API reference, errors, recipes, support.
The whole signing flow — anchors, signers, dispatch, signed PDF, audit
trail, webhooks — sits behind one Bearer-API-key authed endpoint at
https://api.wesign.now/v1/*. No templates required, no portal
redirect for the recipient, no SDK to install. Three real-life calls
ship 90% of integrations.
https://api.letssign.now/v1 is a permanent alias of the same API.
The Base URL section says exactly what
is — and what isn't — the contract.
Three steps to ship
Mint an API key
Go to Developers → API keys in your workspace and
click Create API key. Copy the wsk_live_… token — we only
display the plaintext once. Keys minted before the September 2026
rename start with lsk_live_ and keep working unchanged.
Send your first signing request
Replace YOUR_KEY and run this in a terminal:
curl -X POST https://api.wesign.now/v1/signing-requests \
-H "Authorization: Bearer YOUR_KEY" \
-F "file=@contract.pdf" \
-F 'signers=[{"email":"signer@example.com","role":"signer"}]'Drop [[ls:signature:signer]] anywhere in your PDF and we place a
signature field there. No marker? We auto-append a signature page.
Need the signer to confirm an SMS code before they can sign? Add
phone_e164 and require_sms_verification to the signer — see
Second factor by SMS.
(Optional) Receive real-time events
Register an outbound webhook at
Developers → Webhooks (or pass callback_url
per-request). We POST signing_request.signed as each signer
completes, and document.completed with a key-authenticated
signed-PDF URL when everyone's done. Every delivery is HMAC-signed
(X-WeSign-Signature) —
verify it before trusting the
body.
What's in this site
API overview
Base URL and its alias, versioning, the map of v1 resources.
OpenAPI spec
The machine-readable contract — import it into Postman, Insomnia or a client generator.
Authentication
Bearer keys, key format, rotation, error shape.
Create a signing request
The big endpoint. Multipart or JSON, signers, placement, SMS second factor.
Placement modes
Anchors, auto-append, or explicit coordinates — and why manual placement is retired.
Read + manage
GET docs + signers, remind/withdraw, signed-PDF download, audit-trail PDF.
Templates
Instantiate a locked template with field_values; stage for review first.
Webhooks
Events we emit, signature verification in Node and PHP, retry semantics.
Idempotency
Safely retry network blips without double-sending.
Rate limits
60 requests/minute per API key. Retry-After on 429.
Errors
Stable error codes mapped to HTTP statuses.
Security
Encryption at rest and in transit, signature evidence, webhook signing.
How verification works
Hash lookup, PAdES validation, eIDAS QES detection, trust scope.
