QuillSign documentation

Everything you need to send documents for signature, administer your workspace, and integrate QuillSign with your stack.

Overview

QuillSign turns PDFs into signing workflows. You upload one or more documents, place fields for each recipient, choose a routing order, and send. Recipients open a secure link, complete their fields, and consent to sign. When everyone is done, QuillSign seals the document, records its SHA-256 hash, and appends a certificate of completion with the full audit trail.

Quickstart: send your first envelope

Create an account at /signup (you'll need an invite code, or an organization invite from an admin).
New envelope. From the dashboard, give it a title and upload a PDF, then click Create & place fields.
Add recipients. Enter each person's name and email, pick a role (signer, approver, or CC) and a routing order.
Place fields. Pick a field from the palette and click the document to drop it. Drag to move, drag the corner to resize, click to edit properties.
Send. Click Send for signature. Copy each recipient's signing link from the envelope detail page and share it.
Track. Watch the audit trail build. When complete, download the signed document with its certificate.

Core concepts

Term	Meaning
Envelope	A signing package: one or more documents, a set of recipients, and the fields they complete.
Recipient	A person involved in an envelope, with a role and a routing order.
Field	A placed input (signature, text, etc.) assigned to a signer at specific coordinates.
Template	A reusable envelope with placeholder roles instead of named recipients.
Certificate of completion	An appended page summarizing parties, timestamps, IPs, methods, and document hashes.

Recipients & routing

Each recipient has a role and an order.

Signer — completes assigned fields and signs.
Approver — approves or declines without placing marks on the document.
CC (receives a copy) — gets view/download access; never blocks completion.

Routing order controls sequence. With parallel routing everyone can act at once. With sequential routing, a recipient's turn comes only after everyone with a lower order is done. Recipients sharing the same order form a parallel group inside a sequence. If the sender allows it, a recipient can reassign their responsibility to someone else — recorded in the audit trail. In-person recipients sign on the sender's device.

Fields

Place any of these and assign them to a signer:

Type	Behavior
Signature / Initials	Signer adopts a typed, drawn, or uploaded mark.
Date signed	Auto-filled with the signing date.
Name / Email / Company / Title	Auto-filled from the recipient record.
Text	Free text with optional validation (email, phone, ZIP, or custom regex).
Number / Date	Numeric (with min/max) or calendar date input.
Dropdown / Radio / Checkbox	Choice fields; radios group by name.

Any input field can be marked required or made conditional — shown or required only when another checkbox, radio, or dropdown has a given value. Use anchor placement to drop a field at every occurrence of a phrase like "Sign here:".

Templates & bulk send

Open a prepared envelope and choose Save as template (privately or shared with your organization). To reuse it, open the template, fill in the role placeholders, and send. For single-role templates you can bulk send by pasting a CSV of name,email rows — one envelope is created per row, with each recipient's link returned.

Direct links

For single-signer templates you can publish a direct link (/d/<slug>). Anyone who opens it enters their name and email and immediately starts signing — useful for NDAs, waivers, and intake forms. Links are rate-limited and can be revoked.

Organizations & roles

Create an organization to collaborate. Roles:

Admin — manages members, invites, shared templates, SSO/SCIM, and sees all org envelopes.
Sender — creates and sends envelopes and uses shared templates.
Viewer — read-only access to org envelopes.

Invite teammates with single-use, 14-day invite codes (they can register directly with one), or provision them automatically via SCIM.

SSO (OIDC) setup

QuillSign supports OpenID Connect single sign-on, scoped to your organization's email domain.

In your identity provider (Okta, Microsoft Entra, Google, Auth0, etc.), create an OIDC web application.
Set the redirect URI to the value shown on your Organization → SSO page (it looks like https://quillsign-dev.com/sso/callback).
Copy the IdP's issuer / discovery URL, client ID, and client secret into the SSO form, set your email domain and a default role, and save. QuillSign validates the discovery document immediately.
Members visit the app, choose Sign in with SSO, and enter their work email. New users are provisioned just-in-time into your org.

QuillSign uses the authorization-code flow with PKCE, verifies the ID token signature against your IdP's JWKS, checks issuer/audience/nonce, and requires a verified email.

SCIM provisioning

Automate user lifecycle from your IdP. On Organization → SSO, generate a SCIM token and copy the SCIM base URL (/scim/v2/<orgId>). In your IdP's provisioning settings, paste the base URL and use the token as the bearer credential.

Create / update users → provisioned into your org with the default role.
Deactivate / delete (SCIM active=false) → access is revoked immediately and live sessions are cleared.

Supported endpoints include /Users (with userName eq filtering), /ServiceProviderConfig, /ResourceTypes, and /Schemas.

Security

Documents are sealed with a SHA-256 hash and accompanied by a certificate of completion. Data is encrypted in transit and at rest, with sensitive secrets additionally encrypted using a customer-managed KMS key. Accounts support TOTP MFA, and webhooks are HMAC-signed. See the full security & trust page.

Verifying documents

Every completed document is cryptographically signed so anyone can confirm it's authentic and unaltered — no QuillSign account required.

How signing works

When an envelope completes, QuillSign seals the PDF and signs it with a detached PKCS#7/CMS signature. The signing key is an RSA key held in AWS KMS (the private key never leaves the HSM-backed service), and the signature is issued under a certificate authority we publish. The completed envelope stores the document's SHA-256 and a reference to the signature.

Verify with our tool

Go to the verification page and drop in a completed PDF. We recompute its fingerprint, locate the signature we issued, and validate it — reporting the document title, signers, completion time, and our CA fingerprint.

Verify it yourself with OpenSSL

Download our CA and the document's signature, then verify the detached signature against the PDF:

# 1. Download the CA certificate
curl -O https://quillsign-dev.com/quillsign-ca.pem

# 2. From the envelope, download the completed PDF and its .p7s signature
#    (the "Download signature" button, or the API).

# 3. Verify the detached signature against the PDF.
#    -binary is required: a PDF is binary, so OpenSSL must not
#    apply S/MIME text canonicalization (LF->CRLF) before hashing.
openssl cms -verify -binary -in document.p7s -inform DER \
  -content completed.pdf -CAfile quillsign-ca.pem \
  -purpose any -no_check_time
# -> "CMS Verification successful"

Installing the CA (optional)

If you want your tools to trust QuillSign signatures without passing -CAfile each time, add quillsign-ca.pem to your trust store — for example, your operating system's certificate manager, or your application's CA bundle. This is entirely optional; the verification above works without installing anything.

FAQ

Does QuillSign email my recipients?

Not yet — you share each recipient's secure signing link directly or via the API/webhooks. Email delivery is on the roadmap.

Are the signatures legally binding?

QuillSign captures consent and a detailed audit trail aligned with ESIGN/UETA. Whether an electronic signature is appropriate depends on your document and jurisdiction.

Can I verify a completed document later?

Yes. The envelope records the SHA-256 of the sealed file; re-hash your downloaded copy and compare.

How do I integrate programmatically?

Create an API key under Profile → Developer and see the API reference.