Sign contracts
A server-side PDF signing API hosted in the DuoKey Cockpit: your systems send a document hash, DuoKey signs it with a certificate that never leaves the tenant keystore.
Certificate stays central
No signing certificates shipped to workstations.
Only a hash travels
The document stays with you; only the hash and the signature cross the network.
Every signature traceable
Each signature is tied to a named app in the Cockpit.
Send a hash, not the document.
Your application computes the document hash and sends only that to the signing API. The PDF itself never leaves your systems.
- Works from any system that can call an API.
- No document content on DuoKey servers.
Signed in the tenant keystore.
DuoKey signs the hash with the tenant's certificate and returns the signature, which your application embeds in the PDF.
- The certificate never leaves the Cockpit.
- Your application embeds the returned signature.
One certificate, no copies.
Stop shipping signing certificates and private keys to workstations. One centrally held certificate serves every authorised app.
- Nothing to steal from a laptop.
- Revoke or renew in one place.
Every signature, on record.
Each signature is traceable to a named app, so you know which workflow signed which document and when.
- Evidence for audits and disputes.
- Same Cockpit as your other keys and certificates.
How it works
Only the hash and the signature cross the network
DuoKey signs the hash with the tenant's certificate and returns the signature. Each signing app is scoped and authenticated on its own, with its own bearer-token secret.
Your system
Sends a document hash
DuoKey PDF Sign
Signs with tenant certificate
Signed document
Signature returned
Only the hash and the signature cross the network. The certificate never leaves Cockpit.
- No client application to install, no certificate distributed to workstations
- Bearer-token authenticated, scoped per app: one connector secret per signing use
- Full audit trail of every signature, tied to a named app, not a shared endpoint
- Certificate lifecycle (issuance, renewal, rotation) managed centrally in Cockpit
Stop shipping signing certificates to workstations.
See PDF Sign against your own document workflow, with the certificate held centrally.