Best E-Signature API for SaaS Platforms: Multi-Tenant Embedded Signing

[Tenant Workspace: "Acme Corp"]           [Tenant Workspace: "Starlight Ltd"]
           │                                                   │
           ▼                                                   ▼
┌────────────────────────────────────────────────────────────────────────┐
│                        SaaS Application Backend                        │
│                                                                        │
│  1. Injects tenant_id & tenant branding (sender_name, sender_email)   │
│  2. Dispatches atomic HTTP POST to Signbee REST API                    │
│  3. Records document_id in PostgreSQL (Row Level Security protected)   │
└───────────────────────────────────┬────────────────────────────────────┘
                                    │
                                    ▼
                         [Signbee Signing Cloud]
               (Compiles PDF, delivers unbranded email ceremony)
                                    │
                                    ▼ (Signer executes in mobile web)
┌───────────────────────────────────┴────────────────────────────────────┐
│                    Webhook Consumer: POST /api/webhooks                │
│                                                                        │
│  1. Verifies HMAC-SHA256 signature via X-Signbee-Signature             │
│  2. Resolves tenant_id by document_id in database                      │
│  3. Emits WebSocket event strictly to target tenant's browser session  │
└────────────────────────────────────────────────────────────────────────┘

-- Multi-tenant contracts schema
CREATE TABLE tenant_contracts (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    tenant_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
    document_id VARCHAR(64) NOT NULL UNIQUE,
    document_title VARCHAR(255) NOT NULL,
    recipient_email VARCHAR(255) NOT NULL,
    status VARCHAR(32) NOT NULL DEFAULT 'PENDING',
    signing_url TEXT,
    pdf_download_url TEXT,
    sha256_hash VARCHAR(64),
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    signed_at TIMESTAMPTZ
);

-- Enable Row Level Security (RLS)
ALTER TABLE tenant_contracts ENABLE ROW LEVEL SECURITY;

-- Enforce strict tenant isolation policy
CREATE POLICY tenant_isolation_policy ON tenant_contracts
    FOR ALL
    USING (tenant_id = current_setting('app.current_tenant_id')::UUID);

import { NextRequest, NextResponse } from "next/server";

export async function POST(req: NextRequest) {
  // Extract authenticated tenant session
  const tenantId = req.headers.get("x-tenant-id");
  const { recipientName, recipientEmail, contractTitle, markdownBody } = await req.json();

  // Retrieve tenant branding settings from DB
  const tenantOrg = await db.organizations.findUnique({ where: { id: tenantId } });

  // Dispatch via Signbee REST API
  const response = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      markdown: markdownBody,
      sender_name: tenantOrg.companyName,
      sender_email: `contracts@${tenantOrg.domain}`,
      recipient_name: recipientName,
      recipient_email: recipientEmail,
      webhook_url: "https://api.yoursaas.com/v1/webhooks/signbee",
      expires_in_days: 14,
    }),
  });

  if (!response.ok) {
    const errorText = await response.text();
    return NextResponse.json({ error: errorText }, { status: 500 });
  }

  const { document_id, signing_url } = await response.json();

  // Persist record under tenant context
  await db.tenant_contracts.create({
    data: {
      tenant_id: tenantId,
      document_id,
      document_title: contractTitle,
      recipient_email: recipientEmail,
      status: "PENDING",
      signing_url,
    },
  });

  return NextResponse.json({ success: true, document_id, signing_url });
}

import { NextRequest, NextResponse } from "next/server";
import crypto from "node:crypto";
import { db } from "@/lib/db";
import { eventBus } from "@/lib/event-bus";

export async function POST(req: NextRequest) {
  const rawBody = await req.text();
  const signature = req.headers.get("x-signbee-signature");
  const webhookSecret = process.env.SIGNBEE_WEBHOOK_SECRET!;

  // 1. Verify cryptographic HMAC-SHA256 signature
  const expectedSignature = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawBody)
    .digest("hex");

  if (
    !signature ||
    !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))
  ) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  const { event, document_id, metadata, pdf_download_url, sha256_hash } = payload;
  const tenantId = metadata?.tenant_id;

  if (!tenantId) {
    return NextResponse.json({ error: "Missing tenant_id in metadata" }, { status: 400 });
  }

  // 2. Atomic state update partitioned by tenant_id
  if (event === "document.completed") {
    await db.tenant_contracts.updateMany({
      where: {
        document_id: document_id,
        tenant_id: tenantId, // Strict partition defense
      },
      data: {
        status: "COMPLETED",
        pdf_download_url: pdf_download_url,
        sha256_hash: sha256_hash,
        signed_at: new Date(),
      },
    });

    // 3. Emit isolated tenant WebSocket notification
    eventBus.publish(`tenant:${tenantId}:contracts`, {
      type: "CONTRACT_SIGNED",
      document_id,
      signedAt: new Date().toISOString(),
    });
  }

  return NextResponse.json({ received: true });
}