Automate NDA Signing with an API: Free Template, Code Example, and Legal Architecture

[Inbound Lead / Partner Form]
       │
       ▼ (1) Extract Company, Representative, Purpose, Jurisdiction
[Template Engine (Mustache / Template Literals)]
       │
       ▼ (2) Compile Dynamic Markdown Agreement
[POST https://signb.ee/api/v1/send]
       │
       ├──> (3) Signbee generates immutable PDF & assigns SHA-256 seal
       │
       ▼ (4) Automated Email dispatched to Recipient
[Recipient Signs in Web Browser (No account required)]
       │
       ▼ (5) POST /api/webhooks/signbee (event: document.signed)
[Your Backend / CRM Listener]
       │
       ├──> (6) Verify HMAC-SHA256 Signature
       ├──> (7) Archive signed PDF & Audit Certificate to S3
       └──> (8) Mark Partner Status "ACTIVE" in CRM / Database

# Mutual Non-Disclosure Agreement

**Effective Date:** {{EFFECTIVE_DATE}}

## 1. Parties
This Mutual Non-Disclosure Agreement ("Agreement") is entered into by and between:
- **Party A:** {{COMPANY_A_NAME}}, a {{COMPANY_A_STATE}} entity with its principal place of business at {{COMPANY_A_ADDRESS}} ("Disclosing Party").
- **Party B:** {{COMPANY_B_NAME}}, a {{COMPANY_B_STATE}} entity with its principal place of business at {{COMPANY_B_ADDRESS}} ("Receiving Party").

## 2. Definition of Confidential Information
"Confidential Information" refers to any proprietary information, technical data, trade secrets, software code, product roadmaps, customer lists, or business operations disclosed by either party, whether disclosed orally, visually, or in tangible form.

## 3. Exclusions from Confidentiality
Confidential Information does not include information that:
1. Is or becomes publicly known through no breach of this Agreement by the Receiving Party;
2. Was already in the lawful possession of the Receiving Party prior to disclosure;
3. Is independently developed by the Receiving Party without reference to or reliance upon Confidential Information;
4. Is rightfully received from an independent third party without confidentiality restrictions.

## 4. Obligations of Receiving Party
The Receiving Party agrees to:
- Maintain Confidential Information in strict confidence using at least reasonable care;
- Restrict disclosure solely to employees, contractors, and legal advisors with a legitimate need to know;
- Use Confidential Information solely for evaluating: **{{BUSINESS_PURPOSE}}**.

## 5. Term & Survival
This Agreement shall remain in effect for a period of **{{TERM_YEARS}} years** from the Effective Date. The obligations of confidentiality regarding trade secrets shall survive indefinitely.

## 6. Governing Law & Jurisdiction
This Agreement shall be governed by and construed in accordance with the laws of **{{JURISDICTION_STATE}}**, without regard to conflict of law principles.

By executing this document electronically below, the authorized representatives acknowledge and agree to all terms herein.

import crypto from "crypto";

interface NDAPayload {
  clientCompany: string;
  clientState: string;
  clientAddress: string;
  signerName: string;
  signerEmail: string;
  businessPurpose: string;
}

export async function automateNDADispatch(data: NDAPayload) {
  const currentDate = new Date().toISOString().split("T")[0];

  // Dynamic Markdown compilation
  const markdownContent = `# Mutual Non-Disclosure Agreement

**Effective Date:** ${currentDate}

## 1. Parties
- **Disclosing Party:** Acme Software Systems Inc., a Delaware Corporation ("Acme")
- **Receiving Party:** ${data.clientCompany}, a ${data.clientState} entity with offices at ${data.clientAddress} ("Counterparty")

## 2. Purpose of Disclosure
Evaluation and technical due diligence regarding: ${data.businessPurpose}.

## 3. Obligations & Term
All confidential disclosures remain protected for a period of 2 years from the Effective Date.

By signing below, the parties agree to all legal terms.`;

  const response = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      markdown: markdownContent,
      sender_name: "Acme Legal Operations",
      sender_email: "legal@acme-software.com",
      recipient_name: data.signerName,
      recipient_email: data.signerEmail,
      webhook_url: "https://api.acme-software.com/v1/webhooks/signbee",
      expires_in_days: 7,
    }),
  });

  if (!response.ok) {
    const errorText = await response.text();
    throw new Error(`Failed to dispatch NDA [${response.status}]: ${errorText}`);
  }

  const result = await response.json();
  return {
    documentId: result.document_id,
    signingUrl: result.signing_url,
    status: result.status,
  };
}

import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";

export async function POST(req: NextRequest) {
  const rawBody = await req.text();
  const signature = req.headers.get("x-signbee-signature");
  const webhookSecret = process.env.SIGNBEE_WEBHOOK_SECRET!;

  // Compute expected HMAC-SHA256 signature
  const expectedSignature = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawBody)
    .digest("hex");

  if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
  }

  const event = JSON.parse(rawBody);

  if (event.event === "document.signed") {
    const { document_id, pdf_url, audit_certificate_url, signer_email } = event.data;
    console.log(`NDA ${document_id} signed by ${signer_email}`);

    // TODO: Archive to S3 & update customer CRM status
  }

  return NextResponse.json({ received: true });
}