They sign without ever leaving your app.
No invite email, no tab into someone else’s product. The signing session runs in a pane you place, and tells your page when it is done.
Included on both plans · Drop-in script or your own iframe · No card required
- Account
- Billing
- Agreement
- Go live
Sign your service agreement
takes about a minuteSection 4 · Execution
Signature
CapturedMike Chen · mike.chen@acme.com
Waiting for the signer
- onReady()
- onSigned({ documentId })
- router.push('/go-live')
- Signers never leave your app
- Drop-in script, or your own iframe
- Origins you allow, nothing else
- Same audit trail as every send
Why bother
The email is the part that loses people
The signature is identical either way. What changes is that the person who was ready to sign is still on the page.
No inbox detour
They are already looking at your product. Sending them to their inbox to come back is where onboarding goes to die.
Finished in the same session
Sign-up, agreement and first run in one sitting, not across two days and a reminder.
Your flow keeps control
You choose the next screen, and you hear the instant it should change.
The integration
Three moves, and none of them are a PDF
The template already settled the document, the fields and the roles. Embedding only changes how the session reaches the signer.
Ask for a session instead of an email
Same endpoint as any other send. With embed: true we skip the invites and hand back a signing URL per recipient, good for thirty minutes.
curl https://putmysign.com/v1/templates/tpl_9f3c/send \
-H "Authorization: Bearer $PUTMYSIGN_KEY" \
-H "Content-Type: application/json" \
-d '{ "embed": true, "recipients": [ … ] }'What you get back
The pane talks to your page
An iframe can only show you something. The script adds the four hooks that let your own flow move on at the right moment.
| Field | Type | Description |
|---|---|---|
| onReady | callback | The signing page has loaded. |
| onSigned | callback | This person signed. You get { documentId }. Others may still have to sign, so watch for the document.completed webhook to know the whole thing is done. |
| onDeclined | callback | This person declined. You get { documentId }. |
| destroy() | method | Removes the iframe and stops listening. Call it when you take the component off the page, or the next session fires your handlers twice. |
Who may frame it
Only the origins you name
A signing page any website can wrap is a phishing kit. So each key carries a list of embed origins, and the pane refuses to load anywhere else.
Embed URLs expire after thirty minutes - they stand in for the real signing link rather than being it, so one that leaks is not much use. If a signer comes back later, ask for a fresh URL.
Embed origins
key_live_9f3c…- https://app.yourproduct.comProduction
- http://localhost:3000Local development
- ×https://not-you.exampleRefused to load
A key with no origins set cannot be embedded anywhere at all - a half-finished setup never leaves a signing page exposed.
Nothing is given up for the framing
An embedded signature is a normal signature
Same session, same evidence: every action timestamped with the IP and device behind it, and the same certificate in the finished PDF.
- 18 Jul 2026
- 9:12 AM
All recipients were sent the document
- 19 Jul 2026
- 8:02 AM
Sarah Jones opened the document
203.0.113.14 · Chrome 141 · macOS
- 8:10 AM
Sarah Jones left a comment on page 3
203.0.113.14 · Chrome 141 · macOS
- 20 Jul 2026
- 10:05 AM
Legal Team approved the document
198.51.100.22 · Safari 19 · iOS
- 22 Jul 2026
- 6:04 PM
Mike Chen signed the document
192.0.2.51 · Firefox 142 · Windows
- 6:04 PM
Putmysign sealed the record
SHA-256 · a91f…c30e
The rest of the API
Not everyone is inside your app
Emailed and embedded recipients can sit on the same document - your customer signs in your product, your legal team gets a normal invite.
FAQ
Questions about embedding
What your user sees, who may frame it, whether it counts the same.
What is embedded signing?
The signing session, running inside your own app instead of on our domain. You send with embed: true, we skip the invite emails and hand you a signing URL per recipient, and you put it in an iframe.
Do I have to use your script?
No. The URL works in an iframe you render yourself. The script is there because it also tells you when the signer is done - onReady, onSigned and onDeclined - which an iframe on its own cannot.
How long does an embed URL last?
Thirty minutes. It is a short-lived stand-in for the real signing link rather than the link itself, so one that leaks is not much use. If a signer comes back later, ask for a fresh URL.
Can any site embed my documents?
No. Each key carries a list of embed origins, and a key with no origins set cannot be embedded anywhere at all. That stops a half-finished setup from leaving a signing page any website can wrap.
Is an embedded signature worth the same as an emailed one?
Yes. It is the same signing session either way, with the same timestamps, IP and device captured and the same tamper-evident certificate embedded in the finished PDF. Only the delivery changes.
Can I still email the people who are not in my app?
Yes. Embedded and emailed recipients can sit on the same document, so a customer signs in your product while your own legal team gets a normal invite.
Still stuck? support@putmysign.com
Keep your users in your product
Create a key, allow your domain, and signing becomes one more screen in your own flow.