Implement Document Signing in the Browser

// Backend: processing signed document
async function processDocumentSignature(documentId, userId, signatureDataUrl, metadata) {
  const document = await db.documents.findByPk(documentId);
  // 1. Load original PDF
  const originalPdf = await s3.getObject({ Bucket: BUCKET, Key: document.s3Key }).promise();
  // 2. Compute hash of original for audit log
  const originalHash = crypto.createHash('sha256').update(originalPdf.Body).digest('hex');
  // 3. Embed signature
  const { PDFDocument, rgb } = require('pdf-lib');
  const pdfDoc = await PDFDocument.load(originalPdf.Body);
  const lastPage = pdfDoc.getPages().at(-1);
  // Add signature image
  const signatureImage = await pdfDoc.embedPng(
    Buffer.from(signatureDataUrl.replace(/^data:image\/png;base64,/, ''), 'base64')
  );
  lastPage.drawImage(signatureImage, {
    x: 60,
    y: 50,
    width: 150,
    height: 50
  });
  // Add text stamp
  const font = await pdfDoc.embedFont('Helvetica');
  lastPage.drawText(
    `Signed: ${metadata.signerName}\n${metadata.signedAt.toISOString()}\nIP: ${metadata.ip}`,
    {
      x: 60,
      y: 30,
      size: 8,
      font,
      color: rgb(0.4, 0.4, 0.4)
    }
  );
  const signedPdfBytes = await pdfDoc.save();
  // 4. Save signed version
  const signedKey = `signed/${documentId}/${userId}.pdf`;
  await s3.putObject({ Bucket: BUCKET, Key: signedKey, Body: signedPdfBytes }).promise();
  // 5. Record in DB
  await db.documentSignatures.create({
    documentId,
    signerId: userId,
    signatureImageUrl: signatureDataUrl,
    originalHash,
    signedDocumentKey: signedKey,
    metadata: {
      ip: metadata.ip,
      userAgent: metadata.userAgent,
      signedAt: new Date()
    },
  });
  return signedKey;
}

SMS Confirmation as Simple ES

For legally significant consents, we use SMS confirmation. The code hash is stored in Redis with a TTL of 5 minutes. The code is sent to the phone, the user enters it on the site. After verification, the signature is recorded. This approach reduces costs by 40% compared to QES.

// Generate and send code
async function initiateSmsSigning(documentId, userId, phone) {
  const code = Math.random().toString(36).substring(2, 8).toUpperCase();
  const codeHash = bcrypt.hashSync(code, 10);
  await redis.setex(
    `sms_sign:${documentId}:${userId}`,
    300, // 5 minutes
    JSON.stringify({ codeHash, phone, attempts: 0 })
  );
  await smsService.send(phone, `Document signing code: ${code}. Valid for 5 minutes.`);
}

// Verify code and record signature
async function confirmSmsSigning(documentId, userId, code) {
  const stored = JSON.parse(await redis.get(`sms_sign:${documentId}:${userId}`));
  if (!stored || !bcrypt.compareSync(code, stored.codeHash)) {
    throw new Error('Invalid code');
  }
  await redis.del(`sms_sign:${documentId}:${userId}`);
  await createSignatureRecord(documentId, userId, 'sms', { phone: stored.phone });
}

Multi-Party Signing: Workflow for Multiple Parties

Often a document requires signatures from several participants (e.g., contract between client and contractor). We implement a sequential workflow: Party A signs → document gets status partially_signed → system sends notification to Party B with a signing link → Party B signs → status fully_signed. Both parties receive the final PDF by email. 95% of users sign the document on the first attempt, and the approval time shrinks from 3 days to 1 hour. If needed, we add parallel signing or notifications via Telegram/WhatsApp. The workflow supports up to 10 signers.

What's Included

• Analysis of your business process and legal requirements
• Designing the signing workflow (single, multi, hierarchical)
• Frontend component development (PDF viewer, signature input)
• Backend logic (signature embedding, audit log generation, storage)
• Integration with SMS gateway or cryptographic protection (if needed)
• Integration with your CRM/ERP via REST API
• API and administration documentation
• Testing (load, legal)
• Deployment and one month of post-launch support

Timelines and How to Order

Estimated timelines:

• Basic implementation (viewing + drawn signature) — from 5 business days.
• SMS confirmation — additional 1–2 days.
• Multi-party signing with workflow — 3–4 days.

Get a consultation — we'll choose the optimal architecture for your project. Order document signing implementation today.