Signing a PDF where it is

Some documents are a page rather than words. A lease with initials in the margin of page four; a county form with a box in the corner. Those get signed where they are.

Watch it done: Sign a PDF you already have (3:19) · Upload your own PDF, in depth: an equipment rental agreement (7:57) · What your signer sees (2:34)

Most templates here are text: the wording is the template, and the certificate's fingerprint is of exactly those bytes. A PDF is a different job, because the layout is the document — the whole reason a business has one is that somebody cared where things sit. Extracting the text would throw away the thing they are trying to keep.

So the file is kept whole, byte for byte. The signer sees the pages. The signature goes where the business put it. And the finished document is that same file with the answers drawn on it and the certificate after it.

The one exception is anything in the file that could act on its own once it is signed, in a reader that is not ours: a script that runs when it is opened or a box is pressed, a file attached inside it, a form field somebody could still type in, a layer that shows one thing on screen and another on paper. Those are taken out when it is uploaded, a form field drawn onto the page as it looked, and the business is told what was taken. The file kept, fingerprinted and signed is the file without them. An XFA form, which only Adobe's reader can draw, is refused: printed to a PDF, it uploads.

The boxes it asks for

Every PDF starts with a signature and the date. When the file says where they go, that is where they are put. The rest of what it asks becomes a question on its own box. That covers:

• A line to write on, typed as underscores or drawn, named by its label beside or under it: Signature, Date, Initials, Printed name or anything else. A blank inside a sentence is named by the words around it.
• A box to tick, typed (☐) or drawn. Two or more after a question (Paid by: ☐ Cash ☐ Card) are its answers, each a tick named for both, and any or all of them may be ticked. When the page says to pick one (select one, check one), only one can be: ticking one hides the others after it, as radio buttons are.
• A box drawn to write in, named by the words to its left, above it, or in its own top corner.
• A fillable form's own fields, named by their tooltip, their own name or the words beside them: a list as a choice, a radio button as a tick for its answer.

Text in square brackets, such as [DATE] or [CLIENT NAME], is usually the template’s own words for you to replace, not a place anybody can write, so it is never a box. It is flagged instead, as a note for an attorney is. Every piece of it is highlighted where it is on the pages of the Place step, and listed with its page after the upload, on the Place step and on the Send screen, each with what to do about it:

• A blank: replace it, in the program that made the file, with the words it stands for or with a blank line (__________) where your signer fills it in. Upload the file again and that line gets its box.
• Meant to be there ([Company seal], [emphasis added]): press Keep it beside it. It stays on the page as written, part of the document, and is not flagged again; SignSealer never fills it in or asks for it. A kept one is listed under Kept as part of the document, with Flag it again beside it. Keeping one changes nothing anybody signs, so a published template can have them kept too.

A footnote’s number ([1]), a letter changed in a quotation ([t]he) and the lines a finished agreement carries ([Signature page follows], [Intentionally left blank]) are never flagged. Nor is a field already filled in, a line under a heading, or a box with writing in it, ever a box.

This works on a PDF with its own text: one saved from the program that made it. A scan is pictures of its pages, with nothing to read where it asks to be signed, so its boxes are yours to drag on; the next screen and the Place step say so, and name any page of a typed file that has no words on it.

The file can come from your computer or, with Choose it from Google Drive on the upload step, from your Google Drive: Google asks you to let SignSealer see the one file you pick, it is brought in exactly as an upload is, and a Google Doc comes as a PDF. Nothing of your Google account is kept. And to have each signed copy put in your Drive as well, connect Google Drive under Settings: every document completed from then on goes into a SignSealer folder there, as the same sealed PDF the completion email attaches.

Unless you switch on Read scanned PDFs under Settings. Then a scan is sent to Google Document AI, which reads the words on its first fifteen pages and where each one sits, and its boxes are placed from them within a minute or two, as a typed PDF's are at once; the checks and the AI review read those words too. Up to 100 pages a day. A scan you upload again is placed at once, from the reading already made.

On an agreement between two parties, the signature line under the customer's heading (Client, Renter, Employee) is the signer's. The business's own line is found too: one under its heading (Coach, Company), labelled as its own (Landlord signature), or the other party's line when the customer's is named. It becomes the business's signature, with its date and printed name, signed by whoever the Send screen names as signing for your business, once the person it is sent to has signed. Nobody else is asked for those boxes, and that person is asked for nothing else. A line for a witness or a notary is left without a box. The next screen says what was placed, and how many more places to sign the file has, and the Place step shows every box, the business's in their own colour, to move or remove before you publish.

Where the pages are drawn, and why it matters

By SignSealer, from the file that is signed. The pictures a signer reads are drawn on our own servers, in the API's own process, from the exact bytes that are kept, fingerprinted and sealed; no other service sees the file. Each picture records the SHA-256 of the file it was drawn from, and a signer, a tablet or your own signing page is shown a picture only when that is the template's file now.

They were once drawn in the browser of the person who uploaded the file, which kept every lease off our servers and tied no picture to the file: a picture that said one price over a file that said another would have been read and the other sealed. Since 1 October 2026 the server draws them (00474), at upload and, for anything that missed it, within the minute after.

What a signer gets

One image per page, with ordinary HTML inputs positioned over them. The signing page carries default-src 'none' and no script at all — that is checkable in the response headers, and it does not change for a PDF. An image needs nothing relaxed.

A box on a page is filled in on the page. A question with no box is asked underneath the document, the way every field is. Both hold the signature back until they are answered, if they are required.

Where a box sits

A placement is a page and a rectangle, as fractions of the page a reader sees, with the origin at the top left:

{
  "key": "tenant_sig",
  "label": "Sign here",
  "kind": "signature",
  "place": { "page": 2, "x": 0.12, "y": 0.71, "w": 0.3, "h": 0.05 }
}

Fractions rather than points, because the same box has to mean the same thing in three places that measure differently: a picture at whatever resolution the browser produced, a CSS box at whatever width the signer's phone is, and the PDF itself in points. A fraction survives all three; a pixel survives none of them.

Top-left rather than the PDF's own bottom-left origin, because two of those three are CSS and the third is one subtraction — which lives in the sealer, once, rather than in every screen.

Rotation is handled. A page carrying /Rotate 90 is shown turned, so a fraction is a fraction of the turned page, and the mark is placed and drawn to match.

What can be placed

• Any field the signing adult supplies.
• A staff field, which whoever sends the document fills in: it is shown to the signer filled, and never asked (Questions and fields). It cannot be a signature, initials, a photo or the signing date.
• Not a per-child field: one box cannot hold an answer for four children.

What cannot be placed is refused when the template is saved, rather than accepted and found empty at a counter.

What the certificate says

A template's body is what the certificate fingerprints, and a PDF template has no text to fingerprint. So its body names the file's own SHA-256:

This agreement is the attached document: lease.pdf (4 pages).

The file is identified by its SHA-256 fingerprint 9f2c…8ab1. The signed
copy is that same file, with each answer drawn where it was placed on the
page, and the certificate of completion after it.

The signed fingerprint therefore commits to those exact bytes. Change one byte of the original and the certificate no longer describes it.

The text, and why you cannot edit it

A PDF template's text is the sentence naming the file, and it is fixed. That is not tidiness: it is the sentence's whole job. The certificate fingerprints the body, so naming the file's SHA-256 there is what makes the signature commit to those exact bytes. Take the fingerprint out and the pages are still signed, but nothing in the record says which file they were.

So the dashboard shows it read-only, offers no tidying of it, and the engine refuses a change to it — including through the API. The name, the questions and the boxes change freely; none of those is what the certificate commits to. To change what the text says, use a different file.

Setting one up

In the dashboard, under Templates → a PDF, signed where it is: choose the file, let the pages draw, then drag a box for each question — or type the page and four percentages, which is the same thing and works without JavaScript.

Publishing is refused until every page has a picture. A template with a missing page would send somebody a row of gaps.

What the signer does

They agree to sign electronically, answer anything asked underneath the document, then fill in the boxes on the page, on one step with one Continue. A box that still needs them is red and turns green as they fill it in; an optional one stays blue. Then they sign. Nothing they type is ever on a step whose button posts something else, so nothing arrives blank on the next one.

Two kinds of box are never typed into, because signing fills them:

• A signature box, any signature question placed on a page. It carries the signature they type to sign. They sign once.
• A signing-date box: a date question placed on a page whose key is date, signed_on, date_signed, signing_date or today, or whose label reads Date, Date signed, Signed on or Today's date. It carries the day they signed, in your timezone (asked when you name your business, and under Settings → Messages; Central time until you set one). Any other date, such as Date of arrival, is still asked.

A written template works the same way. {{date}}, and the same names as above ({{today}}, {{signed_on}}, {{date_signed}} and the rest), is never asked for: it is the day the document is first signed, in your timezone, written out in words (September 25, 2026). The signing page shows today's date there; the signature writes it in. A date you mean for something else, such as the day of an event or a rental, needs its own name, like {{event_date}}.

Every time shown for a signing is in the same timezone, and says which: the document's page in the dashboard, the Activity log, the certificate and the verify page all read like 26 Sep 2026, 10:24 pm PDT, with the UTC time the evidence records beside it. So a document signed late in the evening carries the same day in its text as on its record, and the certificate says which timezone that day was taken in. If you change your timezone later, a document already signed keeps the day it was signed with: its times are then shown in your new timezone, and the certificate and the verify page no longer name it as the one that day was taken in.

A blank's name also picks the box it is asked in. {{trip_date}} is a calendar; {{tee_time}} is a time; {{rental_starts}} and {{rental_ends}} are each a day and a time, which is how a rental of a few hours and one of several days are both written. What is picked goes into the document in words (September 27, 2026 at 2:00 pm), and a period whose end comes before its start is refused: _starts and _ends, start_ and end_, arrival and departure, drop_off and pick_up, check_in and check_out are read as the two ends of one period. A question you add yourself can be a time or a date and a time too.

A box keyed full_name or name starts with the signer's name filled in, for them to check. Initials are written in the middle of their box, in the same letters as every other answer.

Before it goes out

A PDF template's own text is the sentence naming the file, so SignSealer reads the words on its pages instead, once, as the file is uploaded, and keeps them with the file: a new version that keeps the file keeps its words. A file from before this, or one whose reading failed, is read within a minute.

Straight after the upload, and again on the last step before it is published, the walk says what the pre-send checks found on the pages: text in square brackets like [insert name] that you have not kept, TBD, lorem ipsum, a document that never says what signing it means. Each is named with its page. A line of underscores is not one of them: on a PDF it is where a box goes. The Send screen runs the same checks on the pages as it runs on a typed text, beside the ones about the people it is going to and the blanks that were filled in.

A note for your attorney on the pages, [Attorney: …], is refused as it is in a typed text: the PDF is not published, and no document is made or sent from one published before the pages were read, and the refusal names the page. Settle it with your attorney and upload the file without it.

What was not read is said rather than passed over. A page with no words on it (a picture, or blank) is named, and a scanned PDF, whose pages are pictures of words, is said to have had nothing to read. Look at those pages yourself.

The AI review reads the same words, on the template's own page (Check with AI, when the business has switched AI review on under Settings). On a membership with the review switched on, it runs on its own as a PDF is uploaded: the upload asks for it, the review runs within a minute, and what it found is on the walk's last step and the template's page. It counts against the day's model runs like any other review. It never reads the naming sentence: that would put a reading of a fingerprint on the record as a reading of the agreement. A scanned PDF is refused in a sentence rather than reviewed as empty, unless Read scanned PDFs is on: then the review waits for Google's reading and reads its words. The review on the send screen still refuses a PDF, and points to the template's page.

The same holds on a public form at /f/…: the panel headed “What you are about to read” says what the document is and that its pages are on the next screen, rather than showing the fingerprint.

From the API

Everything after setup is ordinary. A PDF template is a template: prepare a document from it, send it, read the link, supply fields, sign, and download the sealed copy exactly as for any other. GET /v1/sign/{token} carries the pages, so an integrator building their own signing screen gets the same pictures the hosted page uses:

{
  "title": "Tenancy — Flat 2",
  "body": "This agreement is the attached document: lease.pdf …",
  "pages": [
    { "n": 1, "width": 1275, "height": 1650 },
    { "n": 2, "width": 1275, "height": 1650 }
  ],
  "fields": [
    { "key": "tenant_sig", "label": "Sign here", "kind": "signature",
      "required": true, "supplied": false,
      "place": { "page": 2, "x": 0.12, "y": 0.71, "w": 0.3, "h": 0.05 },
      "at_signing": "signature", "placed_value": null, "placed_words": null }
  ]
}

at_signing marks a box that signing fills: draw it, do not ask for it, and POST /v1/sign/{token} will not refuse for it. placed_value is what a box carries, and placed_words the same as it is printed on the sealed copy — a date as October 5, 2026, a time as 9:00 am — so your screen can show the page the way it will be sealed.

from_sender marks a box filled in by whoever sent the document: a question marked staff and placed on the page, such as pickup_date | Pickup date | date | staff. It is given when the document is sent — under values on POST /v1/documents, or under fields or values when a workflow starts — and a required one that is missing refuses the send, naming it. The signer's link carries it already answered: draw it with its placed_value, do not ask for it, and supplying it is refused.

Each page is an image at GET /s/{token}/page?n=1 — the token is the whole credential, so no API key goes near it and an <img> can load it directly. The images are drawn by SignSealer from the template's file itself, so they are always pictures of the document being signed, and the file itself, before anything is filled in, is at GET /s/{token}/document.pdf.

GET /v1/templates/{id}/pdf says whether a template is a PDF one and whether it is ready to use:

{
  "has_pdf": true,
  "page_count": 4,
  "drawn": 4,
  "ready": true,
  "sha256": "9f2c…8ab1",
  "original_name": "lease.pdf"
}

What is kept

• The file, exactly as uploaded, on the template version. A new version copies it; a new upload replaces it and takes the old pictures and every box with it, because a box chosen against a page that no longer exists is a signature in the margin of the wrong page.
• A picture of each page, drawn by SignSealer from the file, which is what a signer sees.
• The placements, frozen onto each document when it is prepared — so revising a template afterwards never moves a signature on a document somebody already signed.

Retention and redaction work as they do for any document: evidence and certificates explains the package, and the sealed copy is the same artifact with the customer's own pages at the front.