Overview
How qualified signatures work
What a qualified signer sees during the ceremony, what happens behind the scenes, and what you get back
Private beta. Qualified signatures are available on request. See Request access.
A qualified signature takes a few more steps than a regular one, because the signer’s qualified trust service provider (QTSP) has to know who they are and get their approval for this exact signature.
What the signer sees
This is a qualified signing in test mode, with the sandbox worker playing the provider:
Open the ceremony
The signer opens the ceremony from the invitation email, or in your app if you embed it, and completes any authentication you added. That can include an optional identity check that you add, which is separate from anything the provider does.
Consent, review and sign
This part is the same as for a regular signer. The signer consents to sign electronically, reviews the documents, adopts a signature and selects Finish. The qualified signature doesn't exist yet.
Identify and approve at the provider
The provider decides what the signer does here, so it depends on the provider you choose:
- A provider that already knows the signer, from an earlier enrollment, only asks them to approve: a one-time password, a PIN or a confirmation in its app.
- A provider that issues a certificate for this one signature identifies the signer first, for example with an identity document and a selfie, a video call or a national eID. Some do that and the approval in one visit, others in two steps.
If the provider needs a separate identification step, the ceremony shows Confirm your identity to continue, then sends the signer to the provider.
For the approval, the ceremony shows Authorize your signature and sends the signer to the provider. If the signer confirms in the provider's app instead, the ceremony shows Waiting for your confirmation and moves on by itself.
After each visit, the provider sends the signer back to the ceremony.
Done
SignatureAPI embeds the qualified signature in the document, and the ceremony completes.
In test mode, the sandbox worker plays a provider with both steps: an Identify yourself page, then an Authorize your signature page. That way you see both ceremony screens. The ceremony also shows a notice that the signature is not qualified.
Behind the scenes
SignatureAPI reaches the provider through a signing worker: an HTTPS service, run by you or by your provider, that translates SignatureAPI’s requests into calls to the provider’s API. In test mode, the hosted sandbox worker stands in for it. See Signing workers.
When the signer selects Finish, SignatureAPI asks the worker for three things, in order:
- The certificate. A PDF signature references the signer’s certificate, so SignatureAPI usually needs it before it can compute what to sign. If the provider must identify the signer before it issues one, SignatureAPI sends the signer to the provider here. Some providers build the whole signature themselves, and their certificate can arrive with the signature instead.
- The approval. SignatureAPI computes a digest, a short fingerprint of the exact document the signer reviewed, and asks the worker to get the signer’s approval for it. The approval is bound to that digest, so the signer can’t approve one document and have another signed.
- The signature. The worker has the provider sign the digest with the signer’s key.
The worker never sees the document, only the digest. Before embedding the result, SignatureAPI checks that the signature matches the digest and the certificate. A signature that fails the check never reaches the PDF.
What you get back
- On the recipient. The recipient’s
certificateshows the signing certificate’s subject, issuer, serial number and validity dates. - In the deliverable. A single PDF with all of the envelope’s documents, and no audit log. Each qualified signature sits in it as a PAdES signature, the standard format for signatures inside a PDF, so PDF readers list it in their signature panel.
Several qualified signers
An envelope can have as many qualified signers as you need. Each one gets their own signing session, one after another, in the order you list them. Each signature covers the document exactly as it stands at that signer’s turn, including the earlier signatures. That’s why these envelopes use sequential routing. See Envelope rules.