Developers / Guides / Records
E-signature
Lets a merchant send a document — a recurring-payment authorization, a service agreement, anything — to a customer to read and sign online. It is an add-on a merchant switches on. The signing is built into PayMidWare; there is no outside signature vendor.
How it works
- The merchant writes templates in the Admin Portal (Documents → Templates), with merge fields
such as
{{customer.name}}or{{schedule.amount}}, and publishes them. A published version is never edited; each signer gets a frozen copy of the version that was sent. - Sending emails the signer a unique link. When text messaging is on and the signer has a mobile number, they also type a 6-digit code we text them (it works for 10 minutes, 5 tries).
- On the signing page they read the document, tick the electronic-consent box, type their name and tick “I agree” (drawing a signature is optional). They get a sealed PDF with a certificate-of-completion page by email and can download it for 7 days; the merchant can download it any time.
- A payment schedule request can require a signed authorization first: the customer signs, then approves the schedule. Chosen on the Portal's schedule-request forms.
API endpoints
| Endpoint | Purpose |
|---|---|
| GET .../signatures/templates | The merchant's templates and their live version (null means nothing is published, so it cannot be sent). |
| POST .../signatures | Send a document: templateId, signerName, signerEmail, optional signerPhone, customerId, invoiceId, requireTextCode (null = automatic) and sendEmail (false returns the link for you to deliver). |
| GET .../signatures | List requests; filter by status or customerId. |
| GET .../signatures/{requestId} | One request with its timeline. |
| GET .../signatures/{requestId}/document | The sealed PDF (404 until signed). |
| POST .../signatures/{requestId}/void | Withdraw an unsigned request. |
| POST .../signatures/{requestId}/resend | New link (the old one stops working). ?linkOnly=true drops the texted code for this link. |
Statuses: Sent, Viewed, CodeVerified, Signed, Declined, Expired, Voided. Sending needs the merchant's e-signature add-on; reading and downloading do not. Templates are written in the Portal, not the API.
What a signature here is: evidence that the person with access to that email address (and phone, when a code is used)
agreed to the exact text shown, with the time and address recorded and a SHA-256 fingerprint of the text. It is not a vendor-grade
certificate. Have a lawyer review the wording of any payment authorization before publishing it; bank-payment rules (NACHA) ask for specific
authorization language and for keeping the record.