Let customers sign without leaving your app
Your customer is already logged in to your portal, checkout or onboarding flow. Sending them to their inbox to sign breaks the moment. Embedded signing opens SignMaster's signing page inside your app, for exactly the person in front of the screen, and tells your page when they're done.
Updated November 5, 2026 · 2 min read
On this page
How it works
Your server asks SignMaster for a signing session for one signer on an envelope that's already been sent. SignMaster returns a single-use link. You show it in an iframe on your page, or redirect the person to it, and SignMaster reports the outcome back to you. Everything else is the normal signing experience: the consent step, the guided fields, the audit trail and the sealed PDF.
Build it in six steps
- 1
Create a key
In Settings › Developers, create an API key with the embedded:create scope. Keep it on your server, never in the browser.
- 2
Allow your site
Under Allowed origins, add the address your page runs on, like https://app.example.com. Plain http works only for localhost while you develop.
- 3
Send the envelope
Send it from SignMaster as usual, or from your code through the REST API. A session can only open for the signer whose turn it is.
- 4
Ask for a session
Call POST /api/v1/envelopes/{id}/embedded-sessions with the signer's recipient_email (or recipient_id), a return_url, and a frame_origin if you'll show it in an iframe. The reply carries the session's url and when it expires.
- 5
Open it straight away
The url works once and must be opened within 5 minutes, so request it at the moment you show it. After it opens, the signer has up to an hour to finish.
- 6
Handle the result
In an iframe, your page receives signmaster:loaded, signmaster:completed, signmaster:declined or signmaster:error messages. Without one, the signer comes back to your return_url with event=signing_complete, declined, session_expired, link_used or unavailable.
Confirm on your server
A browser event is a hint, not proof. Before you mark an order as signed, check the envelope with GET /api/v1/envelopes/{id}, or listen for the recipient.completed webhook.
Iframe or redirect?
| Iframe | Redirect | |
|---|---|---|
| Feels like | Part of your page | A short trip to SignMaster and back |
| You get the result | As a message to your page | As ?event= on your return URL |
| Needs | frame_origin, listed under Allowed origins | A return URL on an allowed origin |
| Good for | Portals and dashboards on desktop | Phones and tight layouts |
Only the origin you name may frame the page, so another site can't wrap your customer's signing session in its own. The certificate of completion records that the person signed in an embedded session and on which site.
Try it before you write code
Settings › Developers has a Try embedded signing sample you can open in one click, plus a Code section with a ready snippet. The developer docs list the endpoints. In an embedded session the signing page drops SignMaster's logo and shows yours, if you've uploaded one.
Questions? Answers.
Which plans include embedded signing?
Crew and Company, along with the rest of the API. New workspaces can try Crew free for 14 days. Compare plans.
Does the signer still get an email?
Yes. The envelope is sent as usual, so the signer also has their emailed link. Embedded signing adds a second way in while they're in your app.
What if the session expires before they finish?
Your page gets an error with session_expired. Ask your server for a new session and open that one instead.
Can I embed it in a mobile app?
Use the redirect flow: open the session in a web view and watch for navigation to your return URL. The signing page is built for phones.