Put e-signatures inside the software you already run
Your CRM, ERP or client portal can create documents, send them for signature and react the moment they are signed, without anyone opening sign.yt.
A versioned REST API
Everything lives under api.sign.yt/v1 and speaks JSON: documents, recipients, fields, templates and webhooks. Create a document from a template, send it and download the signed PDF in a few calls.
Every request is scoped to the organization that owns the API key, so one integration can never see another tenant's documents. Errors come back as structured JSON with clear status codes, which keeps client code simple.
API keys with scopes
Each organization creates its own API keys and grants each key only the scopes it needs, read or write per area. Keys are stored hashed, only the prefix is shown after creation, and each key is limited to 100 requests per second.
Revoke a key at any time and integrations using it stop immediately. The last-used time helps you spot keys nobody needs any more.
Webhooks you can trust
Subscribe to events such as document.sent, document.viewed, document.signed, document.completed, document.rejected, document.expired and recipient.bounced. Every delivery is signed with HMAC-SHA256 over a timestamp and the raw body, so you can verify it came from sign.yt and reject replays.
Endpoints are re-checked before each delivery to block requests to internal addresses. Each request also carries the event name and a delivery ID in its headers, so you can route and deduplicate events easily.
Retries built in
If your endpoint is down, sign.yt retries after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. Each delivery has a stable ID for deduplication, and failed deliveries are kept so nothing is silently lost.
Every attempt is signed again with a fresh timestamp, so even a retry hours later passes the replay window check on your side.
Start building
Full API reference, a five-minute quickstart and official SDKs for Python and TypeScript.
pip install signytnpm install @signyt/sdkFrequently asked questions
How do I authenticate?
Send your API key as a Bearer token in the Authorization header.
How do I verify a webhook?
Compute HMAC-SHA256 of the timestamp header, a dot and the raw body with your webhook secret, and compare it with the X-Signyt-Signature header.
What happens when my endpoint fails?
sign.yt retries five times over about 15 hours, then marks the delivery as failed.
Which plans include API access?
API keys and webhooks are part of the Business plan and higher.
More features
- Audit trail
Every action is logged in an append-only, hash-chained audit log. Signatures are chained per document and a certificate of completion is added to each PDF.
- GDPR compliance
Data export and erasure requests handled in the product, PDFs encrypted at rest with a separate key per organization, and strict tenant isolation.
- Custom domains
Run e-signatures on your own domain, like sign.yourcompany.com. Point one CNAME record, we verify DNS and issue the TLS certificate automatically.