Build against DocSign in an afternoon.

# 1. Set up your key.
export DOCSIGN_KEY="dsk_..."
export DOCSIGN_BASE="https://docsign.example.com"

# 2. Hash the payload you want signed. SHA-256 hex.
export HASH=$(printf "Sign invoice #4711" | sha256sum | awk '{print $1}')

# 3. POST the request.
curl -sS -X POST "$DOCSIGN_BASE/api/signing-requests" \
  -H "authorization: Bearer $DOCSIGN_KEY" \
  -H "content-type: application/json" \
  -d "{
    \"targetEmail\": \"ada@example.com\",
    \"payloadHash\": \"$HASH\",
    \"payloadPreview\": \"Sign invoice #4711\",
    \"callbackUrl\": \"https://yourapp.com/hooks/docsign\",
    \"expiresInMinutes\": 60
  }"

export class DocSign {
  constructor({ base, apiKey }) { this.base = base; this.apiKey = apiKey; }
  async fetch(path, init = {}) {
    const r = await fetch(this.base + path, {
      ...init,
      headers: {
        "content-type": "application/json",
        "authorization": "Bearer " + this.apiKey,
        ...(init.headers ?? {}),
      },
    });
    if (!r.ok) throw new Error(`DocSign ${path} ${r.status}: ${await r.text()}`);
    return r.json();
  }
  createSigningRequest(body) {
    return this.fetch("/api/signing-requests", { method: "POST", body: JSON.stringify(body) });
  }
}

POST /api/signing-requests HTTP/1.1
authorization: Bearer dsk_...
content-type: application/json

{
  "targetEmail": "ada@example.com",
  "payloadHash": "9f86d081...",            // hex sha256
  "payloadPreview": "Sign invoice #4711",  // optional, human-readable
  "documentId": null,                       // optional, link an uploaded doc
  "callbackUrl": "https://yourapp.com/hooks/docsign",
  "expiresInMinutes": 60
}

200 OK
{
  "id": "cmpqk1d...",
  "signLink": "https://docsign.example.com/sign/cmpqk1d...?t=...",
  "expiresAt": "2026-06-01T12:34:56Z",
  "callbackSecret": "..."                   // returned exactly once
}

GET /api/signing-requests/cmpqk1d...?t=acc-token HTTP/1.1

200 OK
{
  "id": "cmpqk1d...",
  "status": "signed",
  "targetEmail": "ada@example.com",
  "payloadHash": "9f86d081...",
  "expiresAt": "2026-06-01T12:34:56Z",
  "createdAt": "2026-05-29T10:00:00Z"
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyDocSignWebhook(rawBody, headerSig, secret) {
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  if (expected.length !== headerSig.length) return false;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(headerSig));
}

import hmac, hashlib

def verify_docsign_webhook(raw_body: bytes, header_sig: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header_sig)

import { jwtVerify, createRemoteJWKSet } from "jose";

const jwks = createRemoteJWKSet(
  new URL("https://docsign.example.com/.well-known/jwks.json"),
);
const { payload } = await jwtVerify(idToken, jwks, {
  issuer: "https://docsign.example.com",
  audience: CLIENT_ID,
});

// payload.sub is stable per user; payload.email is the verified address.
// If you asked for signing:proof, payload.signing_proof is an Ed25519
// signature you can independently verify with @noble/ed25519.

const partnerNonce = base64url(crypto.getRandomValues(new Uint8Array(16)));
const r = await fetch(BASE + "/api/auth-proof/challenge", {
  method: "POST",
  headers: { "authorization": "Bearer dsk_...", "content-type": "application/json" },
  body: JSON.stringify({
    clientName: "Acme Login",
    partnerNonce,
    callbackUrl: "https://yourapp.com/hooks/docsign-proof",
    expiresInMinutes: 5,
  }),
});
const { signLink, callbackSecret, payloadHashHex } = await r.json();
// Redirect the user to signLink; stash callbackSecret keyed by partnerNonce
// so you can verify the webhook later.

import * as ed from "@noble/ed25519";
import { sha512 } from "@noble/hashes/sha512";
import { createHash, createHmac } from "node:crypto";
ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));

export async function onWebhook(rawBody, headerSig, callbackSecret) {
  // 1. HMAC integrity check.
  const expected = "sha256=" + createHmac("sha256", callbackSecret)
    .update(rawBody).digest("hex");
  if (expected !== headerSig) throw new Error("bad HMAC");

  const body = JSON.parse(rawBody);

  // 2. Reconstruct the canonical payload hash on your side.
  const canonical = [
    body.version, body.audience, body.clientName,
    body.partnerNonce, body.serverNonce, String(body.issuedAtUnixSec),
  ].join("\n");
  const myHash = createHash("sha256").update(canonical).digest("hex");
  if (myHash !== body.payloadHashHex) throw new Error("payload hash mismatch");

  // 3. Ed25519-verify the signature against the returned public key.
  const ok = await ed.verifyAsync(
    base64urlDecode(body.signatureB64u),
    hexDecode(body.payloadHashHex),
    base64urlDecode(body.publicKeyB64u),
  );
  if (!ok) throw new Error("Ed25519 verification failed");

  // body.email + body.identityStatus tell you who the user is.
}

# pubkey.raw  = 32-byte raw Ed25519 public key
# message.bin = the SHA-256 hash bytes that were signed
# sig.bin     = the 64-byte Ed25519 signature
openssl pkeyutl -verify \
  -pubin -inkey <(openssl pkey -pubin -in pubkey.pem) \
  -rawin -in message.bin \
  -sigfile sig.bin

from nacl.signing import VerifyKey
import base64, binascii

pub = VerifyKey(base64.urlsafe_b64decode(pub_b64u + "=="))
pub.verify(binascii.unhexlify(payload_hash_hex),
           base64.urlsafe_b64decode(sig_b64u + "=="))
# raises BadSignatureError on failure

# When you pass businessId, the response also includes a field-by-field
# discrepancy report comparing the registry hit to the user's submission.
curl -X POST https://docsign.example.com/api/business-verification/lookup \
  -H "cookie: docsign_session=..." \
  -H "content-type: application/json" \
  -d '{
    "lei": "HWUPKR0MPOU8FGXBT394",
    "businessId": "cmpq...",
    "forceProvider": "gleif"
  }'

# {
#   "provider": "gleif",
#   "hits": [{
#     "legalName": "Apple Inc.",
#     "registrationNumber": "0000320193",
#     "lei": "HWUPKR0MPOU8FGXBT394",
#     "status": "ACTIVE",
#     "jurisdiction": "US-CA",
#     "address": "ONE APPLE PARK WAY, CUPERTINO 95014, US"
#   }],
#   "discrepancy": {
#     "items": [
#       { "field": "legalName", "user": "Wrong Co", "registry": "Apple Inc.",
#         "severity": "blocker", "note": "names do not match" }
#     ],
#     "overallSeverity": "blocker"
#   }
# }

curl https://docsign.example.com/api/v1/businesses/cmpq.../trust \
  -H "authorization: Bearer dsk_..."

# {
#   "id": "cmpq...", "legalName": "Apple Inc.", "country": "US",
#   "level": "enhanced", "score": 85,
#   "factors": [
#     { "key": "fields_complete",       "passed": true, "earned": 15, "max": 15 },
#     { "key": "registry_confirmation", "passed": true, "earned": 20, "max": 20,
#       "detail": "gleif confirmed registration number" },
#     { "key": "no_sanctions_hits",     "passed": true, "earned": 15, "max": 15 },
#     { "key": "operator_approved",     "passed": true, "earned": 10, "max": 10 }
#   ],
#   "override": null,
#   "via": "api_key"
# }

{
  "sub": "cmpqxxx",
  "email": "ada@example.com",
  "businesses_verified": {
    "count": 2,
    "highestLevel": "enhanced",
    "highestScore": 85,
    "businesses": [
      { "id": "cmpq...", "legalName": "Apple Inc.", "country": "US",
        "level": "enhanced", "score": 85, "status": "approved" }
    ]
  }
}