How to choose an embedded e-signature API
An embedded e-signature API lets the people who use your product sign a document without leaving it: your server creates the document, your page shows the signing screen, and your system hears back when it is done. Most products in this category look alike in a demo. The differences show up in the price list and in the fine print. These are the questions worth asking before you choose.
1. Is embedding part of the plan, or an extra?
In this market, embedded signing is often only on an API plan, and sometimes only on a higher API tier than sending by e-mail. Ask which plan you need for the signing page inside your app, for templates used through the API, and for webhooks.
2. Do you pay per seat, per document, or both?
Per-seat prices add up when many colleagues only send now and then. Per-document prices add up when you grow. Check what happens above the allowance: a hard stop, an overage price, or a forced upgrade.
3. Where do the documents live?
For customers in the EU, ask where documents and personal data are stored and processed, who the sub-processors are, and whether a data processing agreement is part of the terms.
4. How is a signature proven later?
Look for a sealed PDF (PAdES), a trusted timestamp, a certificate of completion with who signed, when and from where, and an event history that cannot be edited quietly. Ask whether a third party, such as a lawyer, can check a PDF without an account.
5. Will it look like your product?
Your colour and logo, the option to hide the provider's header, the signer's own language, a page that works on a phone, and a way to send the person back to your site when they finish.
6. How does your system find out what happened?
Browser events are good for the screen; the source of truth should be server-to-server webhooks with a signature you can check (for example HMAC), retries, and a log where you can resend a delivery.
7. What protects you from mistakes?
Idempotency keys, so a retried request does not send the same contract twice. Short-lived signing links that only work on the websites you list. Clear error codes.
8. Can you try the whole flow before you pay?
A real test is: create from a template, sign inside your page, receive the webhook, download the signed PDF, verify it. If that takes a sales call, the integration will too.
How PenlyDoc answers these
| Question | PenlyDoc |
|---|---|
| Embedding included? | Yes, in the free plan, with templates, API and webhooks. |
| Seats and documents | No price per seat; free during early access (see pricing). |
| Data | Hosted in the EU; processing terms are part of the Terms. |
| Proof | Sealed PDF with timestamp, certificate of completion, hash-chained history, public check page. |
| Look | Your colour, logo and name; header and language picker can be hidden; five languages; phone-first. |
| Events | Browser events plus HMAC-signed webhooks with retries and a resend button. |
| Safety | Idempotency-Key, one-hour links limited to your listed websites, return address checked on the server. |
| Trial | Create an organisation and follow the embedding guide; no card, no call. |
One honest limit: the PenlyDoc seal is our own document seal, not a qualified signature. If your documents need a qualified electronic signature by law, choose a qualified trust service for them.