Embedded signing

Signers with delivery: "embedded" sign in your app. Your app vouches for who they are (the audit trail records customer_asserted, with their client_ref), so only create a session for that signed-in user, when they open the page that shows it.

On your server

const { data: session } = await coss.sign.sessions.create(requestId, signerId, {
  expires_in: 3600,
});
// Hand session.url to the browser. Its token is in the URL fragment: never log it.

Each call makes a new session; it works until expires_at (at most 24 hours) or until the signer has signed. Sessions are refused for email signers (signer_not_embedded), for requests that aren't sent and for signers who already signed or declined.

In the browser

Add your page's origin to your Sign settings' allowed_origins (dashboard, or coss.sign.settings.update), then mount the signing page:

const signing = mountSigning({
  url: sessionUrl,
  container,
  onEvent: (event) => {
    if (event.type === "signed") console.log("Signed; request is", event.request_status);
    if (event.type === "declined") console.log("Declined:", event.reason);
  },
});
// Later: signing.destroy();

The iframe grows with its content. Events: ready, viewed (they opened the documents), signed (request_status is completed when they were the last), declined and error. They come only from the signing page's origin and your iframe; treat them as UI hints and rely on webhooks for your records.

Without allowed_origins, the signing page can't be framed: open session.url in its own tab or redirect to it instead.

Settings