AnySign API

# grab it from this site
curl -O <this-site>/openapi.yaml

# generate a typed client from it
npx @openapitools/openapi-generator-cli generate \
  -i openapi.yaml -g typescript-fetch -o ./anysign-client

# or skip codegen — maintained SDKs ship for
# TypeScript, Python, Ruby, PHP, Java and .NET
npm install @anysign/sdk

curl https://api.anysignhq.com/v1/invoices \
  -H "Authorization: Bearer sk_live_..."

HTTP/1.1 422 Unprocessable Entity

{
  "error": {
    "code": "invalid_field",
    "message": "line_items[0].unit_cents must be a positive integer"
  }
}

curl https://api.anysignhq.com/v1/envelopes \
  -H "Authorization: Bearer sk_live_..." \
  -H "Anysign-Version: 2026-08-14"

# every response carries it back
Anysign-Version: 2026-08-14

npm install @anysign/sdk        # TypeScript / JavaScript
pip install anysign              # Python
gem install anysign              # Ruby
composer require anysign/sdk     # PHP
# Maven: dev.anysign:anysign     # Java
dotnet add package AnySign       # .NET

curl https://api.anysignhq.com/v1/invoices \
  -H "Authorization: Bearer sk_live_..." \
  -H "Idempotency-Key: inv-2026-07-0042" \
  -d '{
    "customer_id": "cus_9d2f1c",
    "currency": "USD",
    "due_date": "2026-07-27",
    "tax_percent": 8.75,
    "line_items": [
      { "description": "Brand identity — phase 2",
        "quantity": 1, "unit_cents": 480000 },
      { "description": "Design system retainer",
        "quantity": 2, "unit_cents": 110000 }
    ],
    "send": true
  }'

const res = await fetch("https://api.anysignhq.com/v1/invoices", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ANYSIGN_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": "inv-2026-07-0042",
  },
  body: JSON.stringify({
    customer_id: "cus_9d2f1c",
    currency: "USD",
    due_date: "2026-07-27",
    tax_percent: 8.75,
    line_items: [
      { description: "Brand identity — phase 2", quantity: 1, unit_cents: 480_000 },
      { description: "Design system retainer", quantity: 2, unit_cents: 110_000 },
    ],
    send: true, // create + send in one call
  }),
});

const invoice = await res.json();
console.log(invoice.number, invoice.hosted_url);

# 1. create — documents, signers, fields in one call.
#    signer_id / document_id take index strings at create.
curl https://api.anysignhq.com/v1/envelopes \
  -H "Authorization: Bearer sk_live_..." \
  -d '{
    "title": "Consulting agreement",
    "signing_order": "sequential",
    "signers": [
      { "name": "Ada Chen",  "email": "[email protected]",  "order": 1 },
      { "name": "R. Okafor", "email": "[email protected]",   "order": 2 }
    ],
    "documents": [
      { "name": "agreement.pdf", "content_base64": "'$(base64 -i agreement.pdf)'" }
    ],
    "fields": [
      { "document_id": "0", "signer_id": "0", "kind": "signature",
        "page": 4, "x": 0.12, "y": 0.68, "w": 0.22, "h": 0.055 },
      { "document_id": "0", "signer_id": "0", "kind": "date",
        "page": 4, "x": 0.12, "y": 0.75 },
      { "document_id": "0", "signer_id": "1", "kind": "signature",
        "page": 4, "x": 0.58, "y": 0.68, "w": 0.22, "h": 0.055 }
    ]
  }'

# 2. send — emails tokenized signing links
curl -X POST https://api.anysignhq.com/v1/envelopes/env_8f14e2/send \
  -H "Authorization: Bearer sk_live_..."

import { readFile } from "node:fs/promises";

const pdf = (await readFile("agreement.pdf")).toString("base64");

const create = await fetch("https://api.anysignhq.com/v1/envelopes", {
  method: "POST",
  headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    title: "Consulting agreement",
    signing_order: "sequential",
    signers: [
      { name: "Ada Chen", email: "[email protected]", order: 1 },
      { name: "R. Okafor", email: "[email protected]", order: 2 },
    ],
    documents: [{ name: "agreement.pdf", content_base64: pdf }],
    // index strings resolve to the records created above
    fields: [
      { document_id: "0", signer_id: "0", kind: "signature",
        page: 4, x: 0.12, y: 0.68, w: 0.22, h: 0.055 },
      { document_id: "0", signer_id: "1", kind: "signature",
        page: 4, x: 0.58, y: 0.68, w: 0.22, h: 0.055 },
    ],
  }),
});
const envelope = await create.json();

await fetch(`https://api.anysignhq.com/v1/envelopes/${envelope.id}/send`, {
  method: "POST",
  headers: { Authorization: `Bearer ${key}` },
});

curl https://api.anysignhq.com/v1/envelopes/env_8f14e2/signing_sessions \
  -H "Authorization: Bearer sk_live_..." \
  -d '{
    "signer_id": "sgn_1a9b3c",
    "return_url": "https://yourapp.com/deals/42?signed=1"
  }'

# → { "url": "https://vault.anysignhq.com/sign/tok_…", "expires_at": "…" }
#   valid 15 minutes, single use — redirect or iframe your signer there

const res = await fetch(
  `https://api.anysignhq.com/v1/envelopes/${envelopeId}/signing_sessions`,
  {
    method: "POST",
    headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
    body: JSON.stringify({
      signer_id: signerId,
      return_url: "https://yourapp.com/deals/42?signed=1",
    }),
  },
);

const { url, expires_at } = await res.json();
// valid 15 minutes, single use
redirect(url);

# Deliveries look like:
POST /hooks/anysign HTTP/1.1
Anysign-Signature: t=1760358000,v1=5f8a2c…
Content-Type: application/json

{ "type": "envelope.completed", "data": { "id": "env_8f14e2", … } }

# Recompute HMAC-SHA256 over "<t>.<raw body>" with your whsec_ secret,
# compare to v1 in constant time, and reject timestamps older than 5 min.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyAnysignSignature(
  payload: string,            // raw request body
  header: string,             // Anysign-Signature: t=<unix>,v1=<hex>
  secret: string,             // whsec_…
  toleranceSeconds = 300,
): boolean {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=") as [string, string]),
  );
  const t = Number(parts.t);
  if (!parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) {
    return false; // stale or malformed — reject replays
  }

  const expected = createHmac("sha256", secret)
    .update(`${parts.t}.${payload}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}