Build on SignedBy. Fast.

Generate a key from Settings → Integration & API — every plan can generate one now, including Free. Send it as a bearer token on every request:

Authorization: Bearer sb_live_...

Missing or invalid keys get a 401. What happens after that depends on your plan: Business is unlimited, Pro and Team are metered (100 free document-sends/month, then billed per document — see /console for pricing), and Free is capped at the same 3 documents/month the dashboard gives you — extendable any time with a one-time $5 pack of 25 extra document credits (never expire, no subscription needed). A capped 402 carries a ready upgrade_urlStripe Checkout link right in the response, so paying doesn't mean leaving the API to go find billing in the dashboard:

401  { "error": "Missing API key. Pass it as 'Authorization: Bearer <key>'." }
401  { "error": "Invalid API key." }
402  { "error": "You've hit the Free plan's 3 documents/month limit. Upgrade to keep going.",
       "upgrade_url": "https://checkout.stripe.com/..." }

Prefer to import this into Postman, Insomnia, or a codegen tool? The full OpenAPI 3.0 specis generated straight from the same request-validation code this API runs — not hand-copied — so it can't drift from what's actually deployed. (First published 2026-09-12.)

curl -X POST https://signedby.ai/api/v1/documents \
  -H "Authorization: Bearer sb_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "3c78a1e4-dc56-4769-87f6-65e344dd6d8f",
    "signer": { "email": "jane@acme.com", "name": "Jane", "auth_required": false },
    "expires_at": "2026-08-15T00:00:00Z",
    "invite_subject": "Please sign your Acme agreement",
    "invite_message": "Thanks for your business — just one form to go."
  }'

201
{
  "id": "7fdd90eb-9152-4031-a767-c0632126dc53",
  "status": "sent",
  "expires_at": "2026-08-15T00:00:00Z",
  "auth_required": false
}

curl -X POST https://signedby.ai/api/v1/documents \
  -H "Authorization: Bearer sb_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "3c78a1e4-dc56-4769-87f6-65e344dd6d8f",
    "signers": [
      { "role": 0, "email": "buyer@acme.com",  "name": "Buyer",  "auth_required": true  },
      { "role": 1, "email": "seller@acme.com", "name": "Seller", "auth_required": false }
    ]
  }'

201
{
  "id": "643d45b3-...",
  "status": "sent",
  "expires_at": null,
  "signers": [
    { "id": "...", "role": 0, "email": "buyer@acme.com",  "auth_required": true  },
    { "id": "...", "role": 1, "email": "seller@acme.com", "auth_required": false }
  ]
}

curl "https://signedby.ai/api/v1/documents?status=completed&limit=20" \
  -H "Authorization: Bearer sb_live_..."

200
{
  "documents": [
    { "id": "...", "title": "Freelance Agreement", "status": "completed",
      "created_at": "2026-07-28T10:04:00Z", "updated_at": "2026-07-29T09:11:00Z",
      "expires_at": null }
  ],
  "total": 42,
  "limit": 20,
  "offset": 0,
  "has_more": true
}

curl https://signedby.ai/api/v1/documents/<document-id> \
  -H "Authorization: Bearer sb_live_..."

200
{
  "id": "...",
  "title": "Freelance Agreement",
  "status": "completed",
  "created_at": "2026-07-28T10:04:00Z",
  "updated_at": "2026-07-29T09:11:00Z",
  "expires_at": null,
  "signers": [
    { "email": "jane@acme.com", "name": "Jane", "status": "signed",
      "signed_at": "2026-07-29T09:11:00Z", "auth_required": false, "auth_verified": false }
  ]
}

curl https://signedby.ai/api/v1/templates \
  -H "Authorization: Bearer sb_live_..."

200
{
  "templates": [
    { "id": "3c78a1e4-...", "name": "Freelance Agreement", "page_count": 3,
      "created_at": "2026-07-01T12:00:00Z" }
  ]
}

curl https://signedby.ai/api/v1/documents/<document-id>/signed-file \
  -H "Authorization: Bearer sb_live_..." -o signed.pdf

200  <binary PDF>
404  { "error": "Signed PDF isn't ready yet." }

curl -X POST https://signedby.ai/api/v1/documents/<document-id>/void \
  -H "Authorization: Bearer sb_live_..."

200  { "success": true }
400  { "error": "Only documents that are out for signature can be voided." }

Available on Pro and higher (previously Business-only). Register one or more endpoint URLs in Settings → Webhooks (each gets its own signing secret). Every enabled endpoint receives all four document lifecycle events:

• document.viewed — the signer opened the link for the first time
• document.signed — one signer completed their part (fires per signer, not just once)
• document.completed — every signer has finished
• document.declined — a signer declined to sign

Payload shape — signer is omitted on document.completed, since that event isn't about one recipient:

{
  "event": "document.signed",
  "occurred_at": "2026-07-30T09:02:11.000Z",
  "document_id": "7fdd90eb-9152-4031-a767-c0632126dc53",
  "title": "Freelance Agreement",
  "status": "sent",
  "signer": { "email": "jane@acme.com", "name": "Jane" }
}

Each delivery is signed with your endpoint's own secret via an X-SignedBy-Signature header:

X-SignedBy-Signature: sha256=6f2c9e...

Verify it (Node.js) before trusting the payload:

const crypto = require("crypto");

function verify(rawBody, signatureHeader, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

Delivery is fire-and-forget with one retry after a 1-second delay (5-second timeout per attempt) — there's no persistent delivery log or manual-redelivery UI yet, so make your endpoint idempotent and check the document's current status via GET /api/v1/documents/{id} if you need to reconcile a missed event.

SignedBy also runs a real Model Context Protocol (MCP) server — ten tools show up ready to call, wrapping the same endpoints above plus Verified Badge sealing and a usage check.

{
  "mcpServers": {
    "signedby": {
      "url": "https://signedby.ai/api/mcp",
      "headers": { "Authorization": "Bearer sb_live_..." }
    }
  }
}

The signer's side is completely unchanged — an AI agent can trigger a signing request through these tools, but the recipient still has to open the link and sign it themselves, through the same per-recipient verification as every other document. Every document an agent creates or voids through this server is tagged in the audit trail (an agent_triggeredflag alongside the usual event log), so it's always possible to tell an agent-initiated send apart from one a person sent directly.

Every tool here is available on every plan, including Free — MCP access itself isn't gated. What varies by plan is volume and templates. On Free: create_and_send_documentneeds an existing template, and Free orgs get exactly one self-saved template (there's no MCP tool to create one — save it once via the dashboard, then send with it here); usage of create_and_send_document and seal_document together is capped at 3 documents/month, extendable any time with a one-time $5 pack of 25 extra document credits (never expire, no subscription needed). Call get_usage any time to check the count without guessing, and if you do hit the cap, the error itself carries an upgrade_url— a ready Stripe Checkout link, so paying doesn't mean leaving the conversation to go find billing in the dashboard.

On Pro, Team, and Business: unlimited templates, and create_and_send_document usage rides on Console's metered access — 100 free document-sends/month, then billed per document, same metering on every plan including Business — not the plain REST API access described in Authentication above, which is metered on Pro/Team and unlimited on Business. See /console for the full pricing.

seal_document works differently by plan (updated 2026-08-28): on Free it shares the 3-document/ month allowance with sending, as above. On Pro and Team it now shares the same 100-free-then-billed Console allowance as create_and_send_document— sends and seals draw from one combined pool, and hitting your own spend cap returns a plain error asking you to raise or turn it off in the console (there's no credit pack to buy here — it's a self-set cap, not a plan limit). On Business, sealing stays fully unlimited and unmetered. It additionally needs a one-time Stripe Identity check on the org (from the dashboard's Settings page, not through this tool) before the first call succeeds, regardless of plan.

A native SignedBy app on Zapier — no generic HTTP module or webhook copy-pasting needed. View SignedBy on Zapier → Three building blocks:

Zapier is a trademark of Zapier Inc.; SignedBy is not affiliated with or endorsed by Zapier.

There's no native SignedBy app in Make's marketplace yet — you don't need one for either direction:

A worked example using Make to connect a Pipedrive deal to a SignedBy contract, start to finish — adapt the same shape for HubSpot, Airtable, or any other CRM.

Pipedrive is a trademark of its respective owner; SignedBy is not affiliated with or endorsed by Pipedrive or Make.

seal_documentabove and the dashboard's own Verified Badge both certify a finished PDF against a real, third-party Time Stamping Authority (RFC 3161) — not just a row in our own database. That means the result can be checked by anyone, without asking SignedBy or trusting our servers to tell the truth about our own documents.

The verification engine is open source and published as a zero-dependency npm package, verifiedby — run the exact same check inside your own app, or send a recipient to verifiedby.dev for the docs and API reference, or truedoc.eu to check a single file with nothing to install.

npm install verifiedby

import { verify } from "verifiedby";

const result = await verify(pdfBytes);
console.log(result.status);
// "verified" | "verified-untrusted-root" | "signed-untimed" |
// "unverified" | "mismatch" | "unsupported" | "no-signature"

Full source, methodology, and the complete status-verdict rubric are on GitHub.