Legally valid digital signatures and seals via the CSC API
Integrate eIDAS-compliant signatures and seals directly into your applications and benefit from complete control over UI/UX and processes. SIGN8’s CSC API connects your systems to our qualified trust infrastructure, without any disruption or external dependencies.
Digital certificate for secure and legally compliant business processes
A digital certificate verifies digital identities and builds trust in electronic processes – such as signatures, seals, time stamps and identity verification.
Companies digitise document-based processes in a secure, traceable and legally valid manner.
What is the CSC API?
The CSC API is a standardised application programming interface developed by the Cloud Signature Consortium. It connects your application to the SIGN8 trust infrastructure and enables you to generate legally valid electronic signatures and seals directly from your own system.
Key management is carried out in hardware security modules (HSMs) with FIPS 140-3 Level 3 certification.
The following are supported:
✅ Qualified electronic signatures (QES) in accordance with eIDAS
✅ Qualified electronic seals (qSeal) in accordance with eIDAS
✅ Signatures in the PAdES, XAdES, CAdES and JAdES formats with ETSI-compliant RFC 3161 timestamps
✅ Advanced electronic signatures (AES) in accordance with eIDAS
All cryptographic operations comply with the ETSI standards EN 319 102-1 and TS 119 432.
Your application will be processed by
– User interface and process logic
– Document and data processing
– Generation of the hash value
– Embedding and further processing of the signature value
SIGN8 takes over
– Secure key management
– Bereitstellung der Credentials
– Autoris- Provision of credentials
– Authorisation of the transaction
– Generation of the cryptographic signature value
– Provision of qualified trust services
The CSC API offers flexible options for digital trust processes
Suitable use cases for the CSC API
The CSC API does not have its own user interface. It runs in the background of your existing application.
The CSC API is designed as a backend service and does not provide its own user interface. Instead, it is integrated into existing IT infrastructures to seamlessly embed digital signature processes into applications such as document management systems, contract workflows, customer portals or specialist applications (e.g. wallets). The API handles the core cryptographic functions – from key management and hash value creation to signature value generation – whilst the front-end implementation (UI/UX) remains entirely the responsibility of the integrator.
Important for integration: The signing process requires the signer to be authenticated (e.g. via OAuth 2.0) in order to meet the compliance requirements for qualified electronic signatures (QES) under the eIDAS Regulation. The API provides the necessary interfaces for this, whilst the actual implementation of the authentication logic (e.g. redirect flows, token handling) takes place in the front-end or via an intermediary authentication service.
This architecture ensures that the integrator retains technical control over user interaction, whilst the CSC API handles the legally compliant generation of digital signatures in the background.
CSC API functions
CSC API functions
Retrieve credentials
Available credentials and associated certificate information can be viewed and selected.
Trigger signatures
Electronic signatures and sealing processes can be initiated directly from your own application.
Signing hash values
Hashes are sent to SIGN8 by the customer via signHash and documentDigests.
Authorise transactions
Signing and sealing procedures are authorised via the designated authorisation process.
Return of signature value
The API returns the signature value (including the certificate chain and the RFC 3161 timestamp).
Step by step: Technical procedure
The signature process complies with the CSC standard ETSI TS 119 432 and comprises:
Requirements for API integration
The CSC API is particularly suitable for organisations that wish to develop their own customised signature processes and manage the technical aspects themselves. To ensure everything runs smoothly, the following requirements must be met:
an existing application, a portal or a specialist process
your own development team or an integration partner
a CSC client and access to the SIGN8 API
Support for REST and OAuth 2.0
a function for generating hash values
the ability to embed the returned signature value
a defined authorisation process
a specification of the required signature or seal level
Technical Fundamentals
The CSC API is based on established web standards and can therefore be integrated into a variety of system architectures.
REST API: Communication with SIGN8 takes place via clearly defined REST endpoints.
- Credential: Digital signature authorisation within the CSC API, which is assigned to a user or organisation and enables access to a cryptographic signature key and the associated certificate.
- CSC endpoints: Certificate information forming part of the credential.
HTTPS: All data is transmitted in encrypted form between your application and the SIGN8 infrastructure.
JSON: Requests and responses are exchanged in a structured, machine-readable format.
OAuth 2.0: Access to the API and the initiation of signature processes are handled via standardised authorisation processes.
Access tokens: Following successful authorisation, your application receives a time-limited token to access the required functions.
CSC endpoints: Standardised endpoints enable, amongst other things, the retrieval of credentials, certificate information and signature results.
signHash: Signs a supplied hash value and returns the raw cryptographic signature value. The signature is embedded into a document outside the API.
signDoc: Enables the signing of documents or other supported input data. The result is either fully signed documents or separate signature objects.
Integrate signature processes directly into your systems
With the CSC API, you can integrate electronic signatures and seals directly into existing applications, portals and specialist processes – end-to-end and without the need for a separate signature application.
The standardised API provides the technical foundation for:
✅ qualified electronic signatures,
✅ qualified electronic seals and
✅ scalable signature processes
to be initiated directly from your own systems – in a standardised, secure and flexible manner.
