mrnewport / laravel-docsign
Document Generation & E-Signatures for Laravel.
Requires
- php: ^8.2
- dompdf/dompdf: ^3.1.6
- illuminate/config: ^12.0 || ^13.0
- illuminate/database: ^12.0 || ^13.0
- illuminate/filesystem: ^12.0 || ^13.0
- illuminate/http: ^12.0 || ^13.0
- illuminate/routing: ^12.0 || ^13.0
- illuminate/support: ^12.0 || ^13.0
- illuminate/view: ^12.0 || ^13.0
- knplabs/knp-snappy: ^1.4
- twig/twig: ^3.0
Requires (Dev)
- mockery/mockery: ^1.6
- orchestra/testbench: ^10.0 || ^11.0
- pestphp/pest: ^3.8
Suggests
None
Provides
None
Conflicts
None
Replaces
None
This package is auto-updated.
Last update: 2026-11-07 04:37:04 UTC
README
Trusted Blade/Twig rendering, PDF engines, persisted Document records and signature-provider contracts. PDF generation works independently; built-in external signing adapters in the published v2.0.0 release explicitly throw, and the local opt-in adapter is a state demonstration.
Current release: 2.1.0. Supported installations: Laravel 12 (PHP 8.2+) and Laravel 13 (PHP 8.3+). CI verifies supported PHP/Laravel combinations. Earlier Laravel versions should remain on the previous major release.
Opt-in private DocuSign transport
Version 2.1.0 adds this opt-in transport. The older built-in external adapters still reject unsupported operations; no real provider call or application send is enabled by installation alone.
DocuSignPrivateSignatureProvider implements PrivateSignatureProviderInterface for application-owned immutable PDF bytes. It validates a locally configured 2048-bit or stronger RSA key, uses separate demo and production JWT hosts, verifies a production account and base URI through UserInfo, sends one transaction ID, reconciles an ambiguous result by that ID, verifies raw Connect HMAC bytes, and fetches completed signed PDF and certificate bytes. The application can call prepare() before reserving an envelope attempt: it authenticates the account without transmitting the PDF or recipient, then reuses that authorization for submit. This lets a known OAuth or consent failure stop before the application's irreversible send fence. A lost response after envelope dispatch remains ambiguous. DocuSign limits transaction-ID lookup to seven days; an application must retain an unresolved attempt after that deadline rather than silently resend. The transport does not decide recipient authority, consent, agreement status, storage, or financial effects. Both mode switches start disabled. An application must retain the exact source and request before calling submit, and must independently review provider artifacts before legal or operational activation.
Private signing accepts exactly one RSA source: an absolute local rsa_private_key_path or bounded in-memory rsa_private_key_pem. Both PKCS#1 and PKCS#8 private keys must be RSA with at least 2048 bits. A caller using an encrypted environment should decode and bind the PEM at runtime; putting it directly in Laravel's cached configuration can write the secret to the config-cache file. Invalid or conflicting sources fail before an HTTP request and errors do not include key material.
Interactive workshop — Try guided examples in your browser.
composer require mrnewport/laravel-docsign:^2.1
If your Composer registry has not indexed the GitHub tag, add its VCS source and repeat the requirement:
composer config repositories.laravel-docsign vcs https://github.com/MrNewport/laravel-docsign composer require mrnewport/laravel-docsign:^2.1
Publish docsign-config, select the storage/template/PDF behavior, then run php artisan migrate. Callbacks default off. A real signing adapter must implement and verify its provider contract; a configured API key alone is insufficient.
Start with the handbook for fresh Laravel 12/13 installation and the complete feature/operational guide. The feature index links every public API, return contract, failure mode and executable reference. The recipes show serious standalone and optional cross-package application use.
Laravel's own PHP runtime requirements apply. Package dependency constraints and current test coverage are described in the handbook. Run composer test in a development checkout; optional browser/renderer checks are documented with their requirements. Installing this package does not automatically integrate another package or authorize application records.