Official SDKs
Thin clients over the REST API for Node.js/TypeScript, Python and PHP: same method names, same errors, idempotency keys on every write and webhook verification built in.
Packages
@quathos/sign (npm) · quathos-sign (PyPI) · quathos/sign (Packagist). Every SDK raises the HTTP status plus the stable detail code, and generates an Idempotency-Key on each write when you do not pass one. Source in the sdks/ directory of the platform repository.Node.js / TypeScript
index.ts
import { QuathosSign, verifyWebhookSignature } from '@quathos/sign';
const sign = new QuathosSign({ token: process.env.QUATHOS_SIGN_TOKEN });
const doc = await sign.documents.upload(pdfBytes, 'Service Agreement');
const env = await sign.envelopes.create({ title: 'Service Agreement', expires_in_days: 14 });
await sign.envelopes.addDocument(env.id, doc.id);
await sign.envelopes.addParticipant(env.id, { name: 'Maria Silva', email: 'maria@example.com', auth_method: 'otp_email' });
await sign.envelopes.send(env.id);Python
main.py
from quathos_sign import QuathosSign, verify_webhook_signature
sign = QuathosSign(token=os.environ["QUATHOS_SIGN_TOKEN"])
doc = sign.documents.upload(pdf_bytes, "Service Agreement")
env = sign.envelopes.create(title="Service Agreement", expires_in_days=14)
sign.envelopes.add_document(env["id"], doc["id"])
sign.envelopes.add_participant(env["id"], name="Maria Silva", email="maria@example.com", auth_method="otp_email")
sign.envelopes.send(env["id"])PHP
index.php
use Quathos\Sign\Client;
$sign = new Client(getenv('QUATHOS_SIGN_TOKEN'));
$doc = $sign->uploadDocument($pdfBytes, 'Service Agreement');
$env = $sign->createEnvelope(['title' => 'Service Agreement', 'expires_in_days' => 14]);
$sign->addDocument($env['id'], $doc['id']);
$sign->addParticipant($env['id'], ['name' => 'Maria Silva', 'email' => 'maria@example.com', 'auth_method' => 'otp_email']);
$sign->sendEnvelope($env['id']);Webhooks
Each SDK ships a verifier for the X-Webhook-Timestamp / X-Webhook-Signature headers (HMAC-SHA256 over "{timestamp}.{body}", five-minute tolerance). Always pass the raw request body — re-serialized JSON changes whitespace and breaks the HMAC.