White-Label E-Signature API: Custom Branding & Custom Domains Guide (2026)

Why Custom Branding & Custom Domains Matter for SaaS

When building modern B2B software—whether an HR platform sending offer letters, a legaltech tool managing NDAs, or a real estate platform processing lease agreements—the contract signing ceremony is the single most critical moment of conversion. Directing signers away from your app to an external third-party domain (such as docusign.net or hellosign.com) introduces friction, visual discontinuity, and security skepticism.

Implementing an esignature api custom branding white-label integration ensures that your application retains full ownership over the end-to-end user relationship. For more context on fundamental white-label concepts, see our white-label e-signature API overview and our detailed SaaS e-signature integration guide.

White-Label Features Breakdown

A true white-label signature integration consists of five core functional modules working in unison. Below is a detailed breakdown of each requirement:

White-Label Feature Matrix

Architecture Guide: CNAME, TLS & Webhooks

Architecting an enterprise-grade custom domain signing system requires automated handling of DNS verification, TLS certificate issuance via the ACME protocol, and securely signed webhook callbacks.

1. CNAME DNS Routing & Host Header Verification

To route signers through your subdomain, your platform customers or ops team configures a DNS CNAME record in your DNS zone file pointing to the API provider's edge routing engine:

# Subdomain CNAME configuration
sign.yourdomain.com.   IN   CNAME   cname.signb.ee.

When a signer makes an HTTPS request to https://sign.yourdomain.com/s/doc_89a1bc, DNS resolves the request to the IP address of cname.signb.ee. The edge reverse proxy receives the TCP connection, extracts the HTTP Host header (sign.yourdomain.com), and queries tenant metadata to verify domain ownership and fetch custom branding rules.

2. Dynamic TLS Certificate Auto-Provisioning

Because the HTTP request uses HTTPS, the edge proxy must terminate TLS using a valid certificate issued specifically for sign.yourdomain.com. Modern e-signature APIs automate this using Let's Encrypt or ZeroSSL via ACME HTTP-01 challenges:

+-----------------+       1. DNS CNAME Query       +----------------------+
| Signer Browser  | -----------------------------> | Customer DNS         |
|                 | <----------------------------- | sign.yourdomain.com  |
+-----------------+   Resolves to cname.signb.ee   +----------------------+
        |
        | 2. HTTPS Request (Host: sign.yourdomain.com)
        v
+-------------------------------------------------------------------------+
|                       Signbee Edge Ingress Engine                       |
|                                                                         |
|  3. Inspect Host header: "sign.yourdomain.com"                          |
|  4. Check TLS Cert Store -> Cache Miss                                  |
|  5. Trigger ACME HTTP-01 Challenge with Let's Encrypt                   |
|  6. CA validates token at http://sign.yourdomain.com/.well-known/acme... |
|  7. Issue Cert -> Cache TLS SNI -> Complete HTTPS Handshake             |
+-------------------------------------------------------------------------+
        |
        | 8. Route to White-Label Webview Engine
        v
+-------------------------------------------------------------------------+
|                  Render Custom Branded UI & Contract                    |
|  (Logo, Primary Accent Colors, Custom CSS Tokens, No Vendor Watermark)  |
+-------------------------------------------------------------------------+

3. White-Label Webhook Dispatches

When signature events occur (e.g. document.viewed, document.completed, signer.declined), the system dispatches webhook notifications to your backend endpoints. Webhooks sent in a white-labeled setup include tenant metadata, custom domain context, and cryptographic HMAC SHA-256 headers for signature verification.

Code Examples: Sending White-Labeled API Requests

Below are complete, production-ready code examples demonstrating how to create white-label branding profiles and send customized signature requests via the Signbee REST API.

1. Creating a White-Label Branding Profile (cURL)

First, configure your custom domain, logo URLs, custom CSS variables, and sender email alias in your workspace settings via API:

curl -X POST https://api.signb.ee/v1/branding/profiles \
  -H "Authorization: Bearer sb_live_99f018a7c62b" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme SaaS Production",
    "custom_domain": "sign.acmesaashq.com",
    "logo_url": "https://cdn.acmesaashq.com/assets/logo-white.svg",
    "favicon_url": "https://cdn.acmesaashq.com/assets/favicon.ico",
    "sender_name": "Acme Contracts",
    "sender_email": "agreements@acmesaashq.com",
    "primary_color": "#2563eb",
    "background_color": "#09090b",
    "font_family": "Inter, sans-serif",
    "custom_css": ".signing-header { border-bottom: 2px solid #2563eb; }",
    "email_template": {
      "subject": "Action Required: {{document_name}} for {{recipient_name}}",
      "button_text": "Review & Sign Document",
      "footer_text": "Sent securely via Acme Cloud Solutions"
    }
  }'

2. Sending a White-Labeled Signature Request (Node.js / TypeScript)

Pass your `branding_profile_id` or custom domain parameters when creating signature requests programmatically:

import { Signbee } from '@signbee/sdk';

const client = new Signbee({
  apiKey: process.env.SIGNBEE_API_KEY!,
});

async function sendWhiteLabeledAgreement() {
  const document = await client.documents.create({
    title: 'Enterprise Software Master Services Agreement',
    contentMarkdown: `
# Master Services Agreement

This Master Services Agreement ("Agreement") is entered into by and between **Acme Cloud Inc.** and **{{client_company}}**.

### 1. Scope of Services
Acme Cloud Inc. agrees to provide enterprise SaaS infrastructure services as detailed in Exhibit A.

### 2. Execution & Validity
By applying an electronic signature below, both parties confirm their acceptance of terms.
`,
    brandingProfileId: 'brand_prof_99a81b',
    customDomain: 'sign.acmesaashq.com',
    sender: {
      name: 'Acme Sales Team',
      email: 'agreements@acmesaashq.com',
    },
    recipients: [
      {
        name: 'Sarah Jenkins',
        email: 'sarah.jenkins@client.com',
        role: 'Signer',
      },
    ],
    metadata: {
      deal_id: 'deal_88192',
      tenant_id: 'acme_tenant_44',
    },
  });

  console.log(`White-label signing link created:`);
  console.log(`URL: https://${document.customDomain}/s/${document.signingToken}`);
  return document;
}

sendWhiteLabeledAgreement().catch(console.error);

3. Verifying White-Label Webhooks (TypeScript / Next.js API Route)

Handle lifecycle event callbacks sent to your backend and verify the cryptographic signature header:

import { NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(req: Request) {
  const bodyText = await req.text();
  const signature = req.headers.get('x-signbee-signature');
  const secret = process.env.SIGNBEE_WEBHOOK_SECRET!;

  // Compute expected HMAC SHA-256 signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(bodyText)
    .digest('hex');

  if (signature !== expectedSignature) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
  }

  const payload = JSON.parse(bodyText);
  const { event, data } = payload;

  switch (event) {
    case 'document.completed':
      console.log(`Document ${data.id} signed under domain ${data.custom_domain}`);
      // Trigger contract storage, CRM sync, or provision tenant
      break;
    case 'document.viewed':
      console.log(`Signer viewed document on ${data.custom_domain}`);
      break;
  }

  return NextResponse.json({ received: true });
}

White-Label E-Signature API Pricing & Cost Analysis

Many legacy e-signature providers treat custom domains and white-labeling as an expensive enterprise add-on feature. For instance, HelloSign (Dropbox Sign) restricts white-labeling to their premium tier starting at $4,999/year, while DocuSign requires custom enterprise negotiation.

For a granular breakdown of costs across developer plans, see our full white-label e-signature API pricing comparison guide. Signbee includes custom domain CNAME routing, custom CSS, and sender email aliases across standard usage-based developer tiers at $0.50 per completed document.

Frequently Asked Questions