Sign a PDF with Python
Send a document for signature from Python with requests, and verify the webhook when it comes back.
Drop your document here and sign it now. PDF, Word and Excel all work: a .docx or .xlsx is laid out in your browser exactly as it was written, so there is nothing to convert first. Add a signature, a date, a company stamp or a watermark, then download it sealed. Free to start, no account, and the file is never uploaded to open it.
Create a document and get a signing link
One POST creates the document, places the fields and returns a signing URL for each signer. The key stays in the environment.
import os, requests
r = requests.post(
"https://api.pdfverified.com/v1/documents",
headers={"Authorization": f"Bearer {os.environ['PDFVERIFIED_API_KEY']}"},
json={
"name": "Services agreement",
"file_url": "https://example.com/agreement.pdf",
"signers": [{"name": "Jane Doe", "email": "jane@example.com", "role": "client"}],
"fields": [{"type": "signature", "signer": "client", "page": 3, "x": 0.12, "y": 0.68}],
"webhook_url": "https://example.com/hooks/pdfverified",
},
timeout=30,
)
r.raise_for_status()
doc = r.json()
print(doc["id"], doc["signing_urls"]["client"])What this ecosystem gets wrong first
- Always pass a timeout. requests has no default one, so a hung connection hangs your worker rather than failing, and this is the single most common way an integration goes wrong in production.
- Use raise_for_status rather than checking the status code by hand: a 422 with a helpful body is much easier to debug when it raises at the call site.
- For Django or Flask, put the call behind a task queue rather than in the request cycle. Uploading a large PDF inside a web request is how you get a gateway timeout on your own site.
Handling the webhook
When a signer completes, we POST the document id, the completion time, the signer record and the SHA-256 fingerprint of the sealed file to your webhook_url. Verify the signature header against the raw request body before you trust any of it, and respond 2xx quickly: do the slow work afterwards, because a webhook that takes ten seconds to answer is a webhook that gets retried.
The fingerprint in that payload is the same value the public verification page checks against, so you can store it and let anybody confirm a document you hold is the one that was signed.
What you get back
- A sealed PDF, with the signature part of the page rather than an annotation some viewers skip
- An audit certificate naming each signer, the time, the address and which checks they passed
- A SHA-256 fingerprint, and a public verification URL that needs no account to open
- Optional company stamps with serial numbers, applied in the same call
The REST API is included on the Business plan at $15 a month rather than sold as an add-on, which is the part worth comparing: several of the platforms a developer evaluates price the API separately and considerably higher.