Embedded E-Signature
For Your Application
Embed in-app electronic signatures directly into your SaaS platform with our powerful API. Signers finish in your app through a signing URL your server requests, not an inbox link.
See it in action
This 5-minute tutorial adds embedded e-signatures to a Node.js app, from requesting a signing URL on your server to showing it to the signer.
Per-Recipient Identity Verification
Verify each signer with an email or SMS passcode, or with an assertion from the identity verification vendor you already use.
Seamless Integration
Embed signing experience via iframe, redirect, or API. Works with any tech stack.
Mobile Optimized
Responsive design works perfectly on desktop, tablet, and mobile devices.
Developer-Friendly
Simple REST API, comprehensive SDKs, and detailed documentation with examples.
Enterprise Security
Bank-level encryption, complete audit trails, and tamper-proof certificates included.
Workflow Automation
Automate document routing, approvals, and notifications with powerful API webhooks.
Embed in Minutes
Choose your integration method. Perfect for developer teams.
import { TurboSign } from '@turbodocx/sdk';
TurboSign.configure({
apiKey: process.env.TURBODOCX_API_KEY,
orgId: process.env.TURBODOCX_ORG_ID,
});
// Create the request and get a signing URL per recipient
const { recipients } = await TurboSign.createEmbeddedSignature({
file: pdfBuffer,
documentName: 'Service Agreement',
recipients: [{
name: 'Jane Doe', email: 'jane@example.com',
auth: { emailOtp: true },
fields: { signature: '{signature1}', date: '{date1}' },
}],
});
// Mount it in your app: no signing email is sent
const signingUrl = recipients[0].embedUrl;Mint the URL the Moment Your Signer Is Ready
Call createSigningUrl at the exact moment a signer is ready, and TurboDocx returns the URL for that recipient. Open it in an iframe, a redirect, or a new tab. What you get depends on how the signer is verified: a passcode or unverified signer gets their reusable signing link, valid for the life of the document, and the passcode gate still applies. A signer verified by your own identity provider (or an admin-enabled override) gets a single-use link that expires about 5 minutes after it is issued, so request it at the moment of signing. When you need OTP, the same call reports which checks are pending so your app can step the signer through them. Walk through the full flow in the createSigningUrl embedding guide.
import { TurboSign } from '@turbodocx/sdk';
// Called when the signer is ready, not hours earlier in an email
const { url, expiresAt, pendingChecks } = await TurboSign.createSigningUrl(documentId, {
recipientId: signer.id,
returnUrl: 'https://app.yourcompany.com/signed',
});
// Passcode or unverified signer: reusable ?token= link for the life of the document.
// External identity verification: single-use ?sut= link, about 5 minutes.
// pendingChecks: ['email_otp'] means the page will ask for a passcode.
iframe.src = url;Three Ways to Place the Signing Experience
One signing URL, three placement modes. Pick the one that fits your product surface.
iFrame Embed
Keep signers inside your app. Drop the URL into an iframe so the signing flow renders in place, with no navigation away from your product.
Full-Page Redirect
Send the signer to the full-page signing experience, then return them to your app with a completion redirect. Best for the simplest, most robust handoff.
New Tab or Popup
Open signing in a separate tab or popup window so your app stays exactly where it was. Useful when signing is one step in a longer workflow.
Deny-by-Default Embedding Domains
The allowedEmbeddingDomains allow-list starts empty, so nothing can iframe your signing page until you add your exact https origin. That is the control that closes the clickjacking gap: an attacker cannot frame the signing experience from a domain you did not explicitly approve. http and localhost origins are accepted for local development only, never for production embedding.
Locking down where the page can be embedded is one half of the story. The other half is knowing who is on the other end. TurboDocx can verify signers before they sign with email OTP, SMS OTP, or an external identity provider assertion selectable per signer, and records the verification method on each signer's certificate of completion. If your app already verified the signer, bring your own identity verification instead.
Native App Experience
Build signature functionality directly into your product. Users stay in your app with zero friction. Our e-signature API makes integration simple for developers.
Enterprise Integration
Advanced features and dedicated support for large organizations with high-volume needs. Perfect for IT teams managing enterprise workflows.
Related Resources
Ready to Embed Signatures?
Get started with our free tier. Full API access included. Need automated document signing workflows? We've got you covered.