Sign PDF (RSA / ECDSA, PAdES)
sign_pdfSign any PDF with a PAdES-compatible digital signature using RSA or ECDSA in one API call.
Instructions
Apply a PAdES-compatible CMS digital signature to a PDF. Since v1.0.0 you can sign ANY PDF in ONE call — autoInjectPlaceholder defaults to true, so you do NOT need to run prepare_signature_placeholder first unless you want to customize the placeholder appearance. Supports RSA-SHA256 and ECDSA-SHA256 (P-256). Required inputs: pdfBase64, algorithm, certDerBase64, plus EITHER rsaKeyPkcs1DerBase64 (when algorithm='rsa-sha256') OR ecPrivateScalarHex / ecPrivateKeyDerBase64 (when algorithm='ecdsa-sha256'). To convert PEM keys to DER base64: openssl pkey -in key.pem -outform DER | base64 -w0. To convert a PEM X.509 cert: openssl x509 -in cert.pem -outform DER | base64 -w0. After signing, call verify_pdf to confirm validity.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | ||
| location | No | ||
| algorithm | Yes | Signature algorithm. ECDSA only supports P-256 in v1.0.0. | |
| pdfBase64 | Yes | Base64-encoded PDF bytes. When the PDF already contains a /Sig placeholder it is signed in place; otherwise the placeholder is auto-injected (set autoInjectPlaceholder=false to opt out). | |
| outputMode | No | base64 | |
| outputPath | No | ||
| signerName | No | ||
| contactInfo | No | ||
| signingTime | No | ISO-8601 timestamp. Defaults to now. | |
| certDerBase64 | Yes | Base64 of the signer X.509 certificate in DER form. Convert from PEM with: openssl x509 -in cert.pem -outform DER | base64 -w0 | |
| ecPrivateScalarHex | No | Hex-encoded P-256 private scalar `d` (exactly 64 lowercase or uppercase hex chars, no 0x prefix). Mutually exclusive with ecPrivateKeyDerBase64; either is accepted for ECDSA. | |
| rsaKeyPkcs1DerBase64 | No | Base64 of the RSA private key in PKCS#1 RSAPrivateKey DER (NOT PKCS#8, NOT PEM). Required when algorithm=rsa-sha256. Convert from PEM with: openssl rsa -in key.pem -outform DER -traditional | base64 -w0 (the -traditional flag forces PKCS#1). | |
| autoInjectPlaceholder | No | When true (default) and the input PDF has no /Sig widget, pdfnative.addSignaturePlaceholder is called before signing — enabling single-call signing of any PDF. | |
| ecPrivateKeyDerBase64 | No | Base64 of an ECDSA P-256 private key in SEC1 (RFC 5915) or PKCS#8 (RFC 5208) DER form. Convert from PEM with: openssl pkey -in key.pem -outform DER | base64 -w0 Mutually exclusive with ecPrivateScalarHex. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| filePath | No | Absolute sandboxed file path (when mode='file'). | |
| sizeBytes | Yes |