Onboarding overview

Overview

Welcome! This guide is designed to help agency users quickly understand and integrate with Signify programmatically. While the main API Documentation provides exhaustive technical specifications for endpoints and parameters, this overview will walk you through the core concepts, setup process, and standard lifecycle for automating document signing.

What Can the Signify API Do?

The Signify API allows your agency’s applications and internal systems to automatically:

• Dispatch documents for digital signing (via email or direct link).
• Monitor the status of pending signatures in real time.
• Retrieve final signed PDF documents securely.
• Manage and delete documents for data hygiene.

Getting Started: Authentication & Security

Signify uses Bearer Token Authentication (API Keys). All requests to the API must be made over HTTPS and include this token.

• Environments: Signify offers a Staging environment for testing and a Production environment. Production secret keys will always begin with the production_v1_ prefix.
  • Staging Base URL: https://staging.signify.gov.sg/public/
  • Production Base URL: https://app.signify.gov.sg/public/
• Generating Your Key: Log in to the Signify dashboard, click on API Integration in the navigation bar, and select Generate API key. If you do not have access to the staging environment, please fill out the support form for your “.gov.sg” email to be whitelisted.
• Security Best Practices: Treat this token like a password. Do not hardcode it in front-end applications, commit it to version control, or share it unencrypted. Use a secrets manager (e.g., 1Password or your cloud provider’s secret manager) to store it securely.

Core Concept: Choosing a Signing Mode

When creating a document via the API, you must choose how signatories will access it. Signify supports two modes:

1. Signing by Email (documentMode: "email"): Your system provides the email addresses of the signatories within the API request. Signify handles sending out the email invitations automatically.
2. Signing by Link (documentMode: "link"): Your system does not provide emails. Instead, the API returns a unique signing link. Your agency is responsible for distributing this link to users (e.g., embedding it in a citizen portal, or sending it via your own custom email/SMS service).

The Standard API Workflow

Integrating with Signify typically follows a 4-step lifecycle:

1. Step 1: Document Creation (POST /documents): You will send a PDF file (up to 10MB) along with metadata (document name, recipients, and signature placeholders) to the Create Document endpoint.
2. Step 2: Tracking Status (GET /documents or GET /documents/:id): You can poll these endpoints to check if a document’s status is draft (pending signatures) or signed (all signatures collected). You can also view the details of individual completed signatures, including timestamps and signatory names.
3. Step 3: Downloading the Signed File (GET /documents/:id/download): Once a document is fully signed, use the download endpoint to securely fetch the final binary PDF file directly into your agency’s backend systems. (Note: Avoid using legacy documentUrl properties, as URL lifetimes are strictly limited to 30 minutes).
4. Step 4: Housekeeping (DELETE /documents/:id): For security and data privacy, you can programmatically delete documents from Signify’s servers once they are safely downloaded and stored in your agency’s internal repository.

Pro Tip for Signature Coordinates: To easily figure out the positionX and positionY values for where a signature should appear on the page, manually create a test document in the Signify Web App, inspect the browser’s network payload, and copy the coordinates for use in your API code!

System Limits & Error Handling

1. Rate Limiting: The API allows up to 100 requests per 10 seconds. Exceeding this will return a 429 Too Many Requests error. We highly recommend implementing exponential backoff in your system to handle this gracefully.
2. Standard Errors: Signify uses standard HTTP codes (e.g., 400 for Bad Requests/Missing Parameters, 401/403 for invalid API keys).

⚠️ Important Notice: Transitioning to API v3

Signify has introduced a new Singpass signing flow which injects larger, fixed-size signatures (7.78cm x 2.12cm) onto documents. To support this and future-proof your integration, please note the following timeline:

API v3 is Live (Available since June 3, 2026): We highly encourage building new integrations on the v3 endpoints. V3 introduces strict validation on signature coordinates (ensuring signatures don’t fall off the bounds of the page) and adds a powerful new allowedIdentifiers (or uin) field, allowing you to restrict document viewing strictly to a specific NRIC/FIN.

API v2 Deprecation (December 1, 2026): The POST /v2/documents endpoint and the legacy documentUrl property will be deprecated on December 1, 2026. If you have an existing v2 integration, please plan your migration to v3 before this date.

Ready to build? Now that you understand the high-level workflow, dive into the adjacent API Documentation tab for exact complete specifications, endpoint schemas, cURL examples, and JSON payloads.