How it works
OneSigner is not a cloud service that signs for you — it is a Windows service you run, on your own machine, with your own USB tokens and your own CA certificates. This page walks through the architecture, the exact moment a signature is made, and everything the system can do. It exists because of what we saw as a global certificate provider — read the story.
The model
Your USB tokens stay plugged into one Windows machine running the OneSigner service. Everything else — your team's browsers, your ERP, your CI pipeline, even external signers you invite by email — connects to that machine and asks it to sign. Files and private keys never pass through One Sign's servers; there is no SaaS in the middle.
Setup
One installer on any Windows machine or VM — an office PC is enough. No database, no dependencies.
OneSigner-Setup.exe
YubiKey, SafeNet, ePass2003 — with the certificates your CA issued. Enter each PIN once in the GUI; it is stored encrypted.
PIN saved · DPAPI-encrypted
Which certificate signs what: appearance and position for PDFs, timestamp server, allowed file types, per-tenant folders and API tokens.
profile → cert + rules
Share the portal on your LAN, or get a public HTTPS address on your own domain — no port-forwarding, no VPN.
https://sign.yourco.com
Under the hood
The same pipeline runs whether the request came from a browser, the API, a folder or your build server.
A PDF or a Windows binary reaches the service — uploaded, dropped into a watched folder, or sent by a signing tool. The matching profile decides which certificate, appearance and timestamp server to use.
For PDFs the signature field is created at the profile's position (or exactly where the caller asked), and a cryptographic digest of the document is computed. For code, the Authenticode structure is prepared the same way signtool would.
OneSigner opens a session to the USB token and supplies the stored PIN — no dialog, no operator. Only the digest travels to the token; the private key physically cannot leave the chip. The token returns the signature.
An RFC 3161 timestamp from your CA's time authority is embedded, so the signature stays verifiable long after the certificate expires. The signature is sealed into the file — PAdES for PDF, Authenticode for code.
Back on the API response, into the output folder, or to the signer's browser — and the event is written to the signing log. With a certificate chained to Adobe's trust list, the PDF opens with the green "Signature valid" tick.
Six ways in
Staff log in, upload, and sign with the company tokens — or drag the signature box exactly where it belongs on the page.
One call to sign and get the file back: POST /api/upload?download=true. Bearer tokens, per-tenant scoping.
Point your ERP's export at a folder. Files land, get signed, and appear in the output folder — no integration code at all.
OneSignTool and AzureSignTool sign builds remotely through a Key-Vault-compatible endpoint — a drop-in -kvu switch, keys still in your token.
Send documents out for signature like DocuSign: signers open an email link, fill fields, and sign in order — no account needed.
Colleagues with their own USB token sign in their browser through the free OneSignerBridge — the PDF never leaves their PC.
The full toolbox
Bulk PDF signers stop at PDFs. OneSigner is a complete signing platform — documents, code, people and pipelines.
Visible or invisible signatures, custom appearance and position, batch whole folders, password-protected PDFs handled.
Authenticode and EV code signing for EXE, DLL, MSI, CAB, SYS — automatic PIN entry, RFC 3161 timestamps, ready for unattended release builds.
YubiKey, SafeNet, ePass2003 and other PKCS#11 tokens — with certificates from your national CA, SSL.com, GlobalSign, Sectigo or any EU trust-list provider.
Multi-signer envelopes with sequential order, signature/text/checkbox fields, access codes, expiry and automatic reminders.
Save field layouts as templates; send one document to a whole list, each recipient getting their own copy to sign.
Render the PDF, drag the signature box, sign with a company or personal token — files stay on your side throughout.
Invitees without tokens draw or type their signature; the document is then sealed with your organisation's digital certificate.
Sign from any system in one HTTP call, or with no code at all via folder watch — status, listing and download included.
AzureSignTool / OneSignTool point at your OneSigner instead of Azure — build servers sign remotely, keys stay in your token.
Separate tokens, folders, API keys and profiles per client or department — built for bureaus, MSPs and shared-services teams.
A public address like sign.yourco.com with TLS handled for you — no port-forwarding, no VPN, reachable by partners.
RFC 3161 timestamps for long-term validity, full signing logs, and an audit trail on every eSign envelope.
Free 30-day trial, every feature unlocked, no credit card. From US$99 one-time when you're ready.
Download free trial