Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: FreeSign — Free e-signature Envelopes API
version: 0.0.0
summary: Free e-signature (electronic signature) API — zero-document PDF signing.
description: FreeSign is a free e-signature (electronic signature, esignature) service. The API accepts hashes, OTP state, signatures, and receipts only. Do not upload PDF bytes. Browser/headless clients compute hashes and generate signatures locally. Output is a standard PAdES-B-T signed PDF, designed for the EU eIDAS Advanced Electronic Signature (AES, Article 26) and US ESIGN/UETA evidence models — legal admissibility is jurisdiction- and fact-specific.
servers:
- url: https://free-sign.com
description: Production
- url: http://localhost:8787
description: Local development
tags:
- name: Envelopes
paths:
/api/envelopes:
post:
summary: Create envelope from local PDF hash and bind the browser's session keypair
description: Posts the SHA-256 of the local PDF AND the public-key JWK of a non-extractable ECDSA P-256 session keypair generated by the browser. The pubkey is persisted write-once on the envelope row; every subsequent protected endpoint requires a signature with the matching private key (see x-fsig-session-* component).
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
document_sha256:
type: string
pattern: ^[a-f0-9]{64}$
session_pubkey_jwk:
type: object
description: 'Public JWK of the browser-generated, non-extractable ECDSA P-256 session keypair. Must contain ONLY {kty: ''EC'', crv: ''P-256'', x, y} — a private ''d'' field is rejected.'
properties:
kty:
type: string
enum:
- EC
crv:
type: string
enum:
- P-256
x:
type: string
description: Base64url EC x coordinate.
y:
type: string
description: Base64url EC y coordinate.
required:
- kty
- crv
- x
- y
required:
- document_sha256
- session_pubkey_jwk
responses:
'200':
description: Envelope created. Returns envelope_id, expires_at, and the canonical session_pubkey_sha256 + session_bound_at the server committed.
content:
application/json:
schema:
type: object
properties:
envelope_id:
type: string
pattern: ^env_[a-f0-9]{32}$
expires_at:
type: string
format: date-time
session_pubkey_sha256:
type: string
pattern: ^[a-f0-9]{64}$
session_bound_at:
type: string
format: date-time
required:
- envelope_id
- expires_at
- session_pubkey_sha256
- session_bound_at
'400':
description: invalid_document_sha256 / invalid_session_pubkey_jwk.
tags:
- Envelopes
operationId: postApiEnvelopes
x-operation-id-source: derived