eDocYouSign API

curl https://YOUR-SITE/api/v1/me \
  -H "Authorization: Bearer edys_xxxxxxxx_yourSecretKey"

import fs from "node:fs";
import { EDocYouSign } from "./edocyousign.js";   // download from https://YOUR-SITE/api/sdk/edocyousign.js

const eds = new EDocYouSign({ baseUrl: "https://YOUR-SITE", apiKey: process.env.EDOCYOUSIGN_KEY });

const { id, accessCode } = await eds.send({
  pdf: fs.readFileSync("contract.pdf"),
  title: "Consulting agreement",
  message: "Please review and sign.",
  recipients: [{ name: "Sam Lee", email: "sam@example.com" }],
  fields: [
    { recipient: 0, type: "signature", page: 0, x: 72, y: 600, w: 160, h: 40 },
    { recipient: 0, type: "date",      page: 0, x: 260, y: 620, w: 100, h: 18 },
  ],
});
console.log(id, accessCode);   // text the access code to Sam; the email never contains it

{
  "title": "Consulting agreement",
  "subject": "Please sign: Consulting agreement",
  "message": "Hi Sam, please review and sign.",
  "ordered": false,
  "pages": 3,
  "enc": { "v": 1, "salt": "…", "iter": 310000, "wrapped": "…", "plainHash": "…", "escrow": "…" },
  "recipients": [ { "id": "r1", "name": "Sam Lee", "email": "sam@example.com", "color": "#2D78D6" } ],
  "fields": [ { "type": "signature", "recipientId": "r1", "page": 0, "x": 72, "y": 600, "w": 160, "h": 40, "required": true } ],
  "agreement": { "type": "Master services agreement", "counterparty": "Acme", "value": 25000, "expiry_date": "2027-12-31", "renewal": "auto" }
}

{
  "id": "evt_5c1f0a9e3b7d42a1c8e6f0b2",
  "event": "envelope.completed",
  "created": "2026-10-17T14:02:11+00:00",
  "workspace": { "id": 12, "name": "Acme Legal" },
  "data": {
    "id": "a0e72ebae6374980", "title": "Consulting agreement", "status": "completed",
    "sender": { "name": "Ann Owner", "email": "ann@acme.co" },
    "recipients": [ { "id": "r1", "name": "Sam Lee", "email": "sam@example.com", "status": "signed", "signedAt": "2026-10-17T10:02:09-04:00" } ]
  }
}

import { EDocYouSign } from "./edocyousign.js";
// Express: app.post("/hooks/edocyousign", express.text({ type: "*/*" }), handler)
async function handler(req, res) {
  const ok = await EDocYouSign.verifyWebhook(req.body, req.get("X-eDocYouSign-Signature"), process.env.EDOCYOUSIGN_WEBHOOK_SECRET);
  if (!ok) return res.sendStatus(400);
  const evt = JSON.parse(req.body);
  res.sendStatus(200);                  // answer within 8 seconds, then do the work
  if (evt.event === "envelope.completed") { /* update your CRM, file the record… */ }
}

import hmac, hashlib, time
def verify(raw_body: bytes, header: str, secret: str, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts.get("t", 0))
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

function verify_edocyousign(string $raw, string $header, string $secret): bool {
    parse_str(str_replace(',', '&', $header), $p);
    if (abs(time() - (int) ($p['t'] ?? 0)) > 300) return false;
    return hash_equals(hash_hmac('sha256', $p['t'] . '.' . $raw, $secret), (string) ($p['v1'] ?? ''));
}

{ "error": { "code": "insufficient_scope", "message": "This key is read-only…", "requestId": "req_8f2c…" } }

# pip install requests cryptography
import os, json, base64, hashlib, secrets, requests
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes

BASE = os.environ.get("EDOCYOUSIGN_URL", "https://edocyousign.com") + "/api/v1"
KEY = os.environ["EDOCYOUSIGN_KEY"]
AUTH = {"Authorization": f"Bearer {KEY}"}
ALPHA = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"

def new_access_code():
    raw = secrets.token_bytes(20)
    c = "".join(ALPHA[b & 31] for b in raw)
    return "-".join(c[i:i + 4] for i in range(0, 20, 4))

def seal(key, data):
    iv = secrets.token_bytes(12)
    return iv + AESGCM(key).encrypt(iv, data, None)

def wrap_for_code(doc_key, code):
    salt = secrets.token_bytes(16)
    kek = PBKDF2HMAC(hashes.SHA256(), 32, salt, 310000).derive(code.replace("-", "").upper().encode())
    return {"v": 1, "salt": base64.b64encode(salt).decode(), "iter": 310000, "wrapped": base64.b64encode(seal(kek, doc_key)).decode()}

def send(pdf_bytes, title, recipients, fields):
    doc_key, code = secrets.token_bytes(32), new_access_code()
    enc = wrap_for_code(doc_key, code)
    enc["plainHash"] = hashlib.sha256(pdf_bytes).hexdigest()
    meta = {"title": title, "pages": 1, "enc": enc,
            "recipients": [{"id": f"r{i + 1}", "name": r["name"], "email": r["email"], "color": "#2D78D6"} for i, r in enumerate(recipients)],
            "fields": fields}
    files = {"meta": (None, json.dumps(meta)), "pdf": ("document.enc", b"EDYS1\n" + seal(doc_key, pdf_bytes), "application/octet-stream")}
    r = requests.post(f"{BASE}/envelopes", headers=AUTH, files=files, timeout=60)
    r.raise_for_status()
    return r.json()["id"], code   # keep the access code safe; share it with signers by phone or SMS

if __name__ == "__main__":
    envelope_id, access_code = send(open("contract.pdf", "rb").read(), "Consulting agreement",
        [{"name": "Sam Lee", "email": "sam@example.com"}],
        [{"type": "signature", "recipientId": "r1", "page": 0, "x": 72, "y": 600, "w": 160, "h": 40}])
    print(envelope_id, access_code)

<?php
// PHP 8+: encrypt a PDF and send it with the eDocYouSign API.
$base = getenv('EDOCYOUSIGN_URL') . '/api/v1';
$key = getenv('EDOCYOUSIGN_KEY');

function seal(string $key, string $data): string {
    $iv = random_bytes(12);
    $ct = openssl_encrypt($data, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);
    return $iv . $ct . $tag;                       // same layout as Web Crypto: IV, ciphertext, 16-byte tag
}
function new_access_code(): string {
    $a = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; $c = '';
    foreach (str_split(random_bytes(20)) as $b) $c .= $a[ord($b) & 31];
    return implode('-', str_split($c, 4));
}

$pdf = file_get_contents('contract.pdf');
$docKey = random_bytes(32);
$code = new_access_code();
$salt = random_bytes(16);
$kek = hash_pbkdf2('sha256', str_replace('-', '', $code), $salt, 310000, 32, true);
$meta = [
    'title' => 'Consulting agreement', 'pages' => 1,
    'enc' => ['v' => 1, 'salt' => base64_encode($salt), 'iter' => 310000, 'wrapped' => base64_encode(seal($kek, $docKey)), 'plainHash' => hash('sha256', $pdf)],
    'recipients' => [['id' => 'r1', 'name' => 'Sam Lee', 'email' => 'sam@example.com', 'color' => '#2D78D6']],
    'fields' => [['type' => 'signature', 'recipientId' => 'r1', 'page' => 0, 'x' => 72, 'y' => 600, 'w' => 160, 'h' => 40]],
];
$tmp = tempnam(sys_get_temp_dir(), 'eds');
file_put_contents($tmp, "EDYS1\n" . seal($docKey, $pdf));
$ch = curl_init("$base/envelopes");
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ["Authorization: Bearer $key"],
    CURLOPT_POSTFIELDS => ['meta' => json_encode($meta), 'pdf' => new CURLFile($tmp, 'application/octet-stream', 'document.enc')]]);
$res = json_decode(curl_exec($ch), true);
unlink($tmp);
echo ($res['id'] ?? json_encode($res)) . " access code: $code\n";