Embedded signing — put the ceremony in your own product
Generate a short-lived signing URL and frame it in your app, with events posted back.
Instead of emailing your user out to SignSpry, keep them in your product. Embedded signing gives you a short-lived URL you can put in an iframe.
Getting a URL
POST /api/v1/envelopes/{id}/recipients/{recipient_id}/embed
{ "return_url": "https://yourapp.com/signed" }Returns:
{ "url": "https://www.signspry.com/sign/<token>?embed=1",
"expires_at": 1787560000 }The URL is valid for 15 minutes and for that one recipient. Generate it when the user is about to sign, not in advance.
Framing it
<iframe src="<url>" width="100%" height="800"
allow="camera" style="border:0"></iframe>The embedded view drops our navigation and branding chrome and shows the document and the signing controls only.
Your origin must be listed under allowed origins on your OAuth client or API key, otherwise the frame is refused. This is what stops someone else embedding your signing sessions.
Listening for events
The frame posts messages to the parent window:
window.addEventListener("message", (e) => {
if (e.origin !== "https://www.signspry.com") return;
switch (e.data.signspry) {
case "viewed": break;
case "signed": /* advance your flow */ break;
case "declined": break;
case "error": break;
}
});Always check e.origin. If you'd rather not use messages, set return_url and we redirect the frame there when signing finishes.
Don't treat the
signed message as proof. It comes from a browser. Confirm server-side with the webhook or by reading the envelope.
Was this useful?