API-First E-Signature Platforms for Developers in 2026: The Definitive Guide

import { z } from "zod";

const ContractPayloadSchema = z.object({
  clientName: z.string(),
  clientEmail: z.string().email(),
  consultantName: z.string(),
  effectiveDate: z.string(),
  hourlyRate: z.number().positive(),
  scopeSummary: z.string(),
});

export type ContractPayload = z.infer<typeof ContractPayloadSchema>;

export interface SignbeeSendResponse {
  id: string;
  status: "pending" | "signed" | "declined";
  signing_url: string;
  created_at: string;
}

export async function dispatchConsultingAgreement(payload: ContractPayload): Promise<SignbeeSendResponse> {
  const validated = ContractPayloadSchema.parse(payload);
  const apiKey = process.env.SIGNBEE_API_KEY;

  if (!apiKey) {
    throw new Error("Missing SIGNBEE_API_KEY environment variable");
  }

  // Define document Markdown as code with dynamic template interpolation
  const documentMarkdown = `
# Professional Services & Consulting Agreement

**Effective Date:** ${validated.effectiveDate}  
**Client:** ${validated.clientName} (${validated.clientEmail})  
**Consultant:** ${validated.consultantName}  
**Agreed Hourly Rate:** $${validated.hourlyRate.toFixed(2)} USD  

---

### 1. Statement of Work
The Consultant agrees to deliver software engineering and architecture consulting services described as follows:
> ${validated.scopeSummary}

### 2. Payment Terms & Invoicing
Invoices will be submitted bi-weekly. Payment is due strictly within thirty (30) days of receipt via electronic bank transfer.

### 3. Intellectual Property Rights
All source code, documentation, architectural diagrams, and inventions produced under this engagement transfer exclusively to the Client upon receipt of full payment.

### 4. Confidentiality & Non-Disclosure
Both parties agree to hold proprietary data and system access credentials in strict confidence under standard commercial standards.
`.trim();

  // Single-endpoint atomic dispatch
  const response = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": `Bearer ${apiKey}`,
      "User-Agent": "Signbee-Node-Client/2026.1",
    },
    body: JSON.stringify({
      markdown: documentMarkdown,
      recipient_name: validated.clientName,
      recipient_email: validated.clientEmail,
      subject: `Consulting Agreement: ${validated.clientName} & ${validated.consultantName}`,
      webhook_url: "https://api.yourcompany.com/webhooks/signbee",
      metadata: {
        crm_deal_id: "deal_98412",
        contract_type: "consulting_v1",
      },
    }),
  });

  if (!response.ok) {
    const errorBody = await response.text();
    throw new Error(`Failed to dispatch agreement: ${response.status} - ${errorBody}`);
  }

  return response.json() as Promise<SignbeeSendResponse>;
}

import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";

const WEBHOOK_SECRET = process.env.SIGNBEE_WEBHOOK_SECRET || "";
const MAX_TIMESTAMP_DRIFT_SECONDS = 300; // 5 minutes

interface SignbeeWebhookPayload {
  event: "document.created" | "document.viewed" | "document.signed" | "document.declined";
  document_id: string;
  recipient_email: string;
  timestamp: string;
  metadata?: Record<string, string>;
  download_url?: string;
  certificate_url?: string;
}

function verifyHmacSignature(rawBody: string, signatureHeader: string | null, timestampHeader: string | null): boolean {
  if (!signatureHeader || !timestampHeader || !WEBHOOK_SECRET) {
    return false;
  }

  // 1. Prevent replay attacks by checking timestamp drift
  const eventTime = parseInt(timestampHeader, 10);
  const currentTime = Math.floor(Date.now() / 1000);
  if (isNaN(eventTime) || Math.abs(currentTime - eventTime) > MAX_TIMESTAMP_DRIFT_SECONDS) {
    return false;
  }

  // 2. Compute expected HMAC SHA-256 digest
  const signaturePayload = `${timestampHeader}.${rawBody}`;
  const hmac = crypto.createHmac("sha256", WEBHOOK_SECRET);
  hmac.update(signaturePayload);
  const expectedSignature = hmac.digest("hex");

  // 3. Constant-time comparison to prevent timing vulnerabilities
  const expectedBuffer = Buffer.from(expectedSignature, "utf8");
  const providedBuffer = Buffer.from(signatureHeader, "utf8");

  if (expectedBuffer.length !== providedBuffer.length) {
    return false;
  }

  return crypto.timingSafeEqual(expectedBuffer, providedBuffer);
}

export async function POST(req: NextRequest) {
  try {
    const rawBody = await req.text();
    const signature = req.headers.get("x-signbee-signature");
    const timestamp = req.headers.get("x-signbee-timestamp");

    const isValid = verifyHmacSignature(rawBody, signature, timestamp);
    if (!isValid) {
      return NextResponse.json({ error: "Invalid cryptographic signature" }, { status: 401 });
    }

    const payload: SignbeeWebhookPayload = JSON.parse(rawBody);

    switch (payload.event) {
      case "document.signed":
        console.log(`[E-Sign] Document ${payload.document_id} signed by ${payload.recipient_email}`);
        // Trigger fulfillment, update database record, notify sales team
        break;

      case "document.viewed":
        console.log(`[E-Sign] Signer opened document: ${payload.document_id}`);
        break;

      case "document.declined":
        console.warn(`[E-Sign] Document declined: ${payload.document_id}`);
        break;

      default:
        console.log(`[E-Sign] Unhandled event: ${payload.event}`);
    }

    return NextResponse.json({ received: true }, { status: 200 });
  } catch (err: any) {
    console.error("[Webhook Error]", err);
    return NextResponse.json({ error: "Internal processing error" }, { status: 500 });
  }
}

import fs from "node:fs/promises";
import path from "node:path";

export async function archiveSignedDocument(documentId: string, outputDirectory: string): Promise<{ pdfPath: string; certPath: string }> {
  const apiKey = process.env.SIGNBEE_API_KEY;
  if (!apiKey) throw new Error("Missing SIGNBEE_API_KEY");

  // Fetch signed PDF binary
  const pdfResponse = await fetch(`https://signb.ee/api/v1/documents/${documentId}/download`, {
    headers: { Authorization: `Bearer ${apiKey}` },
  });

  if (!pdfResponse.ok) {
    throw new Error(`Failed to fetch signed PDF: ${pdfResponse.statusText}`);
  }

  // Fetch SHA-256 Audit Certificate of Completion
  const certResponse = await fetch(`https://signb.ee/api/v1/documents/${documentId}/certificate`, {
    headers: { Authorization: `Bearer ${apiKey}` },
  });

  if (!certResponse.ok) {
    throw new Error(`Failed to fetch audit certificate: ${certResponse.statusText}`);
  }

  const pdfBuffer = Buffer.from(await pdfResponse.arrayBuffer());
  const certBuffer = Buffer.from(await certResponse.arrayBuffer());

  const pdfPath = path.join(outputDirectory, `${documentId}-signed.pdf`);
  const certPath = path.join(outputDirectory, `${documentId}-audit-cert.pdf`);

  await fs.mkdir(outputDirectory, { recursive: true });
  await fs.writeFile(pdfPath, pdfBuffer);
  await fs.writeFile(certPath, certBuffer);

  return { pdfPath, certPath };
}