ZapSign
Create ZapSign PDF requests with Bearer credentials and typed SignatureKit errors.
ZapSign uploads a PDF, creates the signer list, and returns the first signing URL when available. The provider owns the external ceremony; SignatureKit owns request validation and typed errors.
Installation
npm install @signature-kit/http @signature-kit/zapsignWhen to use
Use ZapSign when the product wants a hosted signing link after a simple PDF upload. Use local A1/PDF signing when no upstream ceremony is involved.
Keep credentials Redacted
Provider tokens enter as Redacted.make(...) and are unwrapped only inside the package HTTP boundary. Never pass remote tokens to React components or logs.
Minimal request
import * as Alchemy from "alchemy"
import { ZapSignSignatureRequest, providers as zapSignProviders } from "@signature-kit/zapsign"
import { signatureHttpClientLive } from "@signature-kit/http"
import { Effect, Layer, Redacted } from "effect"
export default class Contracts extends Alchemy.Stack<Contracts>()(
"Contracts",
{
providers: Layer.merge(
zapSignProviders({
apiToken: Redacted.make(process.env.ZAPSIGN_API_TOKEN ?? ""),
environment: "sandbox",
locale: "pt-br",
}),
signatureHttpClientLive,
),
state: Alchemy.inMemoryState(),
},
Effect.gen(function* () {
return yield* ZapSignSignatureRequest("service-agreement", {
title: "Service agreement",
message: "Review and sign this document.",
documents: [{ fileName: "contract.pdf", mimeType: "application/pdf", contentBase64: pdfBase64 }],
recipients: [{ name: "Ada Lovelace", email: "ada@example.com", routingOrder: 1 }],
send: true,
})
}),
) {}Provider facts
- The
environmentoption accepts"production","sandbox", or"brazil"(base URLhttps://br.api.zapsign.com.br/api/v1). - Accepts a single PDF per request, matching ZapSign document upload.
- Authorization uses a Redacted bearer token.
- Unsupported MIME types or multiple documents fail before the HTTP call.
Errors
Invalid input, remote HTTP failures, and invalid response shapes fail as SignatureKitError. The provider, operation, and HTTP status fields are preserved when the upstream response exposes them.
Related
How is this guide?