@esignlaunchpad/sdk

Official JavaScript SDK for embedding eSign Launchpad signing ceremonies in your application.

Build

cd Platform.SDK
npm install
npm run build

Outputs to Platform.eSignPortal/wwwroot/sdk/v1/ (committed to git per the vuedist artifact pattern). Each build emits content-hashed filenames + a latest.json with SRI hashes.

Customer integration

Script tag (UMD)

<!-- Pin to a content-hashed filename + SRI for tamper-proof loading -->
<script src="https://www.esignlaunchpad.com/sdk/v1/esignlaunchpad-abc123.js"
        integrity="sha384-..."
        crossorigin="anonymous"></script>
<script>
  window.eSignLaunchpad.signing({ url: signingUrl })
    .mount('#agreement-container')
    .on('sessionEnd', payload => {
      // payload.event matches SigningCeremonyEvent vocabulary
      console.log('signing ended:', payload.event);
    });
</script>

Get the latest content-hashed filename + SRI from https://www.esignlaunchpad.com/sdk/v1/latest.json.

ESM (Vite / webpack / etc.)

import { signing, DisplayFormat } from '@esignlaunchpad/sdk';

signing({
  url: signingUrl,
  displayFormat: DisplayFormat.Focused,
  style: { primaryButton: { backgroundColor: '#1e40af', color: '#ffffff' } },
})
  .mount('#agreement-container')
  .on('ready', () => console.log('iframe loaded'))
  .on('sessionEnd', payload => console.log('done:', payload));

Public API

• signing(options) — create a session
• Signing.mount(selector | element) — drop the iframe into the page
• Signing.on('ready' | 'sessionEnd', handler) — subscribe to lifecycle events
• Signing.unmount() — clean teardown
• DisplayFormat.Classic | DisplayFormat.Focused
• SigningCeremonyEvent — string constants for all terminal-state event names

Security

• Single-use HMAC-signed signing URLs are the security boundary
• postMessage receiver verifies event.origin matches the signing-page origin
• Style overrides are hard-allowlisted (only hex colors, only primaryButton.{backgroundColor,color})
• The eSign Launchpad attribution footer is non-overridable in v1 (phishing protection)

Versioning

/sdk/v1/... is the v1 path. v2 will ship under /sdk/v2/... so existing v1 customers don't break.