Signathing

Signathing API

Send a PDF for signature from your own software or from an AI agent, and get back a certified copy whose history anyone can verify without trusting you or us. One HTTP call, or one MCP tool call. No subscription. The first 100 documents a month are free; after that you pay per document from a balance you top up when you like.

Why a third party, when your agent could sign things itself

A signature only matters on the day it is disputed. On that day the party that controlled the signing system is the party with something to gain, and its own logs are "trust me." Signathing is nobody's party to the contract. Every signing event (sent, opened, signed, declined, completed, voided) is appended to one public hash chain. Each entry commits to the private details through a hash without publishing them. The chain head is sealed once a day and the day's page is archived by the Internet Archive, a third party we cannot edit. Change one byte of history and every hash after it breaks, in public. The log is at signathing.com/transparency; the verifier is open and dependency-free; the certificate inside every signed PDF carries per-signature codes that anyone can check at signathing.com/verify.

Pricing

  • Documents 1 to 100 each month: free. No card needed.
  • 101 to 500: $0.06 each. 501 to 3,000: $0.03 each. 3,001 and up: $0.025 each. Tiers are marginal, like tax brackets: 500 documents in a month is $24, 3,000 is $99, 10,000 is $274.
  • One document sent is one unit, regardless of signers (up to 25 signers plus 25 view-only recipients). Reminders, downloads, status checks, evidence packages and the public log are free. Void a document within 10 minutes of sending and the unit comes back.
  • Prepaid: add $10, $20, or any amount from your dashboard. Funds never expire. Optional auto top-up with a monthly cap you set. We email you at 50% and 25% of your last top-up and when your pace says the balance runs out within 7 days and 2 days.
  • Documents already out for signature always finish, even at a zero balance. Only new sends pause.

Get a key

Sign in at signathing.com/dashboard/api, create a key, and send it as a bearer token. REST base URL: https://signathing.com/api/v1. MCP endpoint: https://signathing.com/api/mcp.

Give it to your AI agent (MCP)

Signathing is an MCP server, so an agent can send, track, remind, void, pull the evidence package and verify signature codes as native tools. Tools: send_document, get_document, list_documents, remind_document, void_document, get_account, get_evidence, verify_signature_code. The transport is Streamable HTTP. Sign in with OAuth, or send an API key as a bearer header.

Claude.ai, ChatGPT and other chat apps: add a custom connector (remote MCP server) with the URL https://signathing.com/api/mcp. You will be sent to signathing.com to sign in and approve; nothing to paste. Disconnect any time under API in your dashboard.

# Claude Code
claude mcp add --transport http signathing https://signathing.com/api/mcp \
  --header "Authorization: Bearer sk_live_..."

# Cursor, VS Code, Windsurf (mcp.json)
{ "mcpServers": { "signathing": {
    "url": "https://signathing.com/api/mcp",
    "headers": { "Authorization": "Bearer sk_live_..." } } } }

# Grok (xAI Responses API): a remote MCP server tool
{ "type": "mcp", "server_label": "signathing",
  "server_url": "https://signathing.com/api/mcp",
  "headers": { "Authorization": "Bearer sk_live_..." } }

# Claude API (Messages API, mcp_servers)
{ "type": "url", "name": "signathing", "url": "https://signathing.com/api/mcp",
  "authorization_token": "sk_live_..." }

Every client above also accepts the OAuth route: leave the header out and sign in when prompted. Stdio-only clients can use the dependency-free bridge at github.com/jacejb/signathing-mcp. For plain function calling with any model, the OpenAPI 3.1 description is at /api/v1/openapi.json and a plain-text summary for agents at /llms.txt.

Send a document (REST)

curl https://signathing.com/api/v1/documents \
  -H "Authorization: Bearer sk_live_..." \
  -F "file=@contract.pdf" \
  -F "title=Deck contract" \
  -F "message=Please sign by Friday." \
  -F 'signers=[{"name":"Pat Lee","email":"pat@example.com","role":"Customer","phone":"+12705551234"},
               {"name":"Office","email":"office@example.com","viewer":true}]' \
  -F 'fields=[{"id":"sig1","type":"signature","signerIndex":0,"page":1,"x":10,"y":70,"w":28,"h":5.5},
              {"id":"date1","type":"date","signerIndex":0,"page":1,"x":45,"y":70,"w":16,"h":3.2}]'

Fields are optional placed boxes in percent of the page (top-left origin). Types: signature, initials, date, name, email, text, number, checkbox, radio, dropdown. Radio and dropdown take options (2 to 20 strings); required defaults to true except for checkboxes; name and email fill themselves from the signer. signerIndex counts signers only, in the order you listed them. With no fields, signers sign on a certificate page appended to the PDF. A phone number texts the signer their link too. Add sequential=1 to deliver links one signer at a time, and expires_days=14 to set an expiry. Send only view-only recipients to deliver a document for reading: it completes when everyone has opened it and the certified copy carries a Certificate of Delivery instead of signatures.

The response is the document, including a private signing_url per signer (we email and text it; you can also deliver it yourself), its fingerprint in the public log, the evidence URL, and a billing block with what the send cost.

Other calls

GET  /api/v1/documents?status=sent&limit=50     list your documents
GET  /api/v1/documents/:id                      status, signers, events
GET  /api/v1/documents/:id/download?which=signed  the certified PDF (which=original for the upload)
GET  /api/v1/documents/:id/evidence             the evidence package (JSON)
POST /api/v1/documents/:id/remind               nudge everyone who has not signed (once an hour)
POST /api/v1/documents/:id/void                 { "reason": "..." } withdraw an open document
GET  /api/v1/account                            balance, usage this month, projection
GET  /api/v1/usage?month=2026-10                the month's ledger

Public, no key:
GET  /api/evidence/log?from=1&to=1000           the chain, up to 1000 entries per call
GET  /api/evidence/log?day=2026-10-18           one UTC day
GET  /api/evidence/days                         sealed days: head hash + Internet Archive snapshot
GET  /api/evidence/document/:fingerprint        every entry for one document
GET  /api/verify?code=XXXX-XXXX-XXXX-XXXX       the record behind a signature code

Errors come back as { "error": { "code", "message" } }. Codes you will see: unauthorized (401), invalid_request (400), insufficient_balance (402), not_found (404), not_open (409), rate_limited (429, 120 requests a minute). Amounts in responses are in tenths of a cent: 1000 is $1.00.

The digital seal

Every certified PDF is digitally sealed with Signathing's document seal certificate after the signatures, stamps and certificate pages are in. Change a byte and the seal breaks; Acrobat and most readers show it under Signatures with no call to us. The seal is our own certificate rather than an Adobe-trusted vendor one, so a reader may say "validity unknown" until you trust the public certificate at /.well-known/signathing-seal.pem; its SHA-256 fingerprint is printed on every certificate page. The API and evidence package report sealed: true once it is applied.

The evidence package

For any document you sent, GET /api/v1/documents/:id/evidence (or the Evidence package button in the dashboard, or the get_evidence tool) returns one JSON file a lawyer can work from: SHA-256 of the original and the signed PDF, every signer with their verification code, and every event with its private preimage (time, IP, device), its detail hash, its sequence number in the public chain, the hash before and after it, and the sealed day head with the archive link. The package ends with the recipe to recompute all of it. Or run the open verifier:

curl -O https://signathing.com/verifier/verify-signathing.mjs
node verify-signathing.mjs evidence.json original.pdf signed.pdf
#   ok   original PDF matches 6152...
#   ok   event 311 signed -> chain seq 1042
#   ok   seq 1042 is identical in the public log
#   ok   day 2026-10-18 sealed head matches (archived: https://web.archive.org/web/...)
# All checks passed

What the public log never contains: names, emails, phone numbers, IP addresses, devices, or documents. Those live only in your evidence package and in the certificate inside the signed PDF.

Webhooks

Set one HTTPS URL in your dashboard. We POST JSON for document.sent, signer.viewed, signer.signed, signer.declined, document.completed and document.voided. The body is { id, event, created_at, data } where data is the document as returned by the API. Verify the Signathing-Signature header: it is t=<unix seconds>,v1=<hex> where v1 is HMAC-SHA256 of t + "." + rawBody with your webhook secret. Reply with any 2xx within 10 seconds; anything else is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours.

// Node
const [t, v1] = sig.split(",").map((p) => p.split("=")[1]);
const expected = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex");
const ok = crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));

Fair use on the website

Sending from the Signathing app and website stays free with no document cap for people. Automated sending through the website is limited to 60 documents per account per day; software should use the API or the MCP server, which are built for it and include the free 100 a month.

Questions: info@allcontrax.com. Signathing is operated by AllContraX LLC.

Free, and not the kind of free with a catch

Unlimited documents, unlimited signers, certified PDFs on every one. No trial clock and no card to start.

Start signing free