Add e-signatures to
a Dart or Flutter app

Add http for HTTP requests and crypto for HMAC-SHA256. Both are standard Dart/Flutter packages with no native code dependencies.

# pubspec.yaml
dependencies:
  http: ^1.2.0
  crypto: ^3.0.3

# dart pub get

Exchange client credentials for a bearer token. Cache the token and refresh before the 3600-second expiry. In Flutter, store credentials in flutter_secure_storage — never hardcode them.

import 'dart:convert';
import 'package:http/http.dart' as http;

Future<String> getToken(String clientId, String clientSecret) async {
  final response = await http.post(
    Uri.parse('https://api.getsigned.app/oauth/token'),
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: {
      'grant_type':    'client_credentials',
      'client_id':     clientId,
      'client_secret': clientSecret,
    },
  );
  if (response.statusCode != 200) throw Exception('Auth failed: ${response.body}');
  return jsonDecode(response.body)['access_token'] as String;
}

Upload the PDF as a multipart request with signer details and field coordinates. The API returns the envelope ID you use to send.

Future<String> createEnvelope({
  required String token,
  required List<int> pdfBytes,
  required String signerName,
  required String signerEmail,
}) async {
  final request = http.MultipartRequest(
    'POST',
    Uri.parse('https://api.getsigned.app/v1/envelopes'),
  )
    ..headers['Authorization'] = 'Bearer $token'
    ..fields['signers'] =
        jsonEncode([{'name': signerName, 'email': signerEmail}])
    ..fields['fields'] =
        jsonEncode([{'type': 'signature', 'page': 1, 'x': 300, 'y': 580, 'w': 200, 'h': 60}])
    ..files.add(http.MultipartFile.fromBytes(
      'document', pdfBytes,
      filename: 'document.pdf',
      contentType: MediaType('application', 'pdf'),
    ));

  final streamed = await request.send();
  final body = await streamed.stream.bytesToString();
  if (streamed.statusCode != 201) throw Exception('Create failed: $body');
  return jsonDecode(body)['id'] as String;
}

Call /send to dispatch the signing link. When the signer completes, GetSigned POSTs to your server. Verify the HMAC-SHA256 signature with the crypto package before processing.

import 'package:crypto/crypto.dart';

Future<void> sendEnvelope(String token, String envelopeId) async {
  final response = await http.post(
    Uri.parse('https://api.getsigned.app/v1/envelopes/$envelopeId/send'),
    headers: {'Authorization': 'Bearer $token'},
  );
  if (response.statusCode != 200) throw Exception('Send failed: ${response.body}');
}

// In your server-side Dart webhook handler (shelf / dart_frog):
bool verifyHmac(List<int> rawBody, String sigHeader, String secret) {
  final hmac = Hmac(sha256, utf8.encode(secret));
  final computed = hmac.convert(rawBody).toString();
  // Constant-time compare — accumulate differences, never return early
  if (computed.length != sigHeader.length) return false;
  var diff = 0;
  for (var i = 0; i < computed.length; i++) {
    diff |= computed.codeUnitAt(i) ^ sigHeader.codeUnitAt(i);
  }
  return diff == 0;
}

// envelope.completed → download sealed PDF:
// GET /v1/envelopes/$id/document
// Authorization: Bearer $token