White-Label E-Signature API: Embed Signing in Your SaaS Under Your Brand

export async function dispatchWhiteLabelContract() {
  const response = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      markdown: "# Master Services Agreement\n\nBetween Acme SaaS Inc. and Client...",
      // White-label brand parameters:
      sender_name: "Acme Cloud Services",
      sender_email: "contracts@acme-cloud.com",
      recipient_name: "Jordan Lee",
      recipient_email: "jordan@clientcorp.io",
      // Custom brand URL routing:
      redirect_url: "https://acme-cloud.com/onboarding/complete?doc_id={document_id}",
      webhook_url: "https://api.acme-cloud.com/v1/webhooks/signbee",
      expires_in_days: 14,
    }),
  });

  const { document_id, signing_url } = await response.json();
  return { document_id, signing_url };
}

import os
import requests

SIGNBEE_API_KEY = os.environ.get("SIGNBEE_API_KEY")

def send_tenant_contract(tenant_id: str, tenant_name: str, tenant_email: str, recipient_name: str, recipient_email: str, markdown: str):
    payload = {
        "title": f"Services Agreement — {tenant_name}",
        "markdown": markdown,
        "sender_name": tenant_name,
        "sender_email": tenant_email,
        "recipient_name": recipient_name,
        "recipient_email": recipient_email,
        "redirect_url": f"https://{tenant_id}.yourplatform.com/contracts/success",
        "webhook_url": f"https://api.yourplatform.com/webhooks/signbee/{tenant_id}"
    }

    res = requests.post(
        "https://signb.ee/api/v1/send",
        headers={
            "Authorization": f"Bearer {SIGNBEE_API_KEY}",
            "Content-Type": "application/json"
        },
        json=payload
    )

    if res.status_code != 200:
        raise RuntimeError(f"Signbee API call failed: {res.text}")

    return res.json()

import express, { Request, Response } from "express";
import crypto from "crypto";

const app = express();

app.post(
  "/api/webhooks/signbee/:tenantId",
  express.raw({ type: "application/json" }),
  async (req: Request, res: Response) => {
    const { tenantId } = req.params;
    const signature = req.headers["x-signbee-signature"] as string;

    // 1. Retrieve tenant-specific webhook secret from database
    const tenant = await db.tenants.findUnique({ where: { id: tenantId } });
    if (!tenant) return res.status(404).send("Tenant not found");

    // 2. Timing-safe HMAC verification
    const expected = crypto
      .createHmac("sha256", tenant.webhookSecret)
      .update(req.body)
      .digest("hex");

    if (!crypto.timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(signature, "utf8"))) {
      return res.status(401).send("Invalid tenant signature");
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    
    // 3. Mark contract executed in tenant database partition
    await db.contracts.update({
      where: { documentId: payload.document_id, tenantId },
      data: {
        status: "signed",
        signedPdfUrl: payload.signed_pdf_url,
        signatureHash: payload.signature_hash,
        executedAt: new Date(payload.timestamp)
      }
    });

    res.status(200).json({ success: true, tenantId });
  }
);