E-signatures with an API that actually feels modern.
SpitShake is the API-first document signing platform for developers embedding signatures, automating contracts, and shipping compliance-first pipelines in minutes — not quarters.
HIPAA-ready SOC 2 controls AES-256 at rest SHA-256 chain audit
# Send a contract for signing
curl https://spitshake.io/api/submissions \
-H "X-Auth-Token: $SPITSHAKE_KEY" \
-H "Content-Type: application/json" \
-d '{
"template_id": 42,
"submitters": [{
"role": "Signer",
"email": "ada@acme.com",
"name": "Ada Lovelace"
}]
}'
# → 201 Created. Email sent. Webhook fires on completion.
✓ submission_id: sub_7f3a
Why SpitShake
Legacy e-sign was built for procurement. We built it for engineers.
Legacy platforms
Clunky iframe embeds
Wrestle with z-index, sandbox attrs, and layout shift.
Legacy platforms
Per-seat pricing + surprises
Overage bills, "envelopes," and sales calls to raise limits.
Legacy platforms
Webhooks as an afterthought
Limited events, flaky retries, no signed payloads.
SpitShake
Web components + JWT iframes
Drop in React, Vue, Angular, RN. No layout gymnastics.
SpitShake
Flat per-submission pricing
Predictable, usage-based. No "talk to sales" to get started.
SpitShake
14 webhook events, signed
Form, field, submission, template lifecycle. HMAC-signed, retried.
The platform
Everything you'd build. Already built.
Templates, multi-party signing, audit trails, identity verification, payments — the primitives a modern signing workflow needs.
Embed in minutes
Web components for React, Vue, Angular, React Native. JWT-signed iframes for everything else. Ship a signing flow this afternoon.
<spitshake-form
token="eyJhbGciOiJIUzI1..."
theme="light"
/>
AI field detection
Upload any PDF. SpitShake auto-detects signature, date, and text fields and places them at pixel-perfect coordinates.
Multi-party & witness
Ordered or parallel signing. Witness sign-off. Delegation between signers.
Compliance-first
HIPAA BAA, SOC 2 controls, AES-256 encryption, immutable SHA-256 chain audit, TSA timestamps.
Identity verification
SMS OTP, KBA quizzes, email 2FA. High-assurance signing when you need it.
Integrations
Zapier, n8n, MCP server, 14 webhook events. Wire it to your stack in minutes.
Developer-first
First submission in under 5 minutes.
REST API with cursor pagination, HMAC-signed webhooks, and official SDKs for TypeScript, Python, and React.
curl https://spitshake.io/api/submissions \
-H "X-Auth-Token: $SPITSHAKE_KEY" \
-d '{
"template_id": 42,
"submitters": [
{ "role": "Signer", "email": "ada@acme.com" }
]
}'
import { SpitShake } from '@spitshake/api';
const client = new SpitShake({ apiKey: process.env.SPITSHAKE_KEY });
const submission = await client.submissions.create({
template_id: 42,
submitters: [{ role: 'Signer', email: 'ada@acme.com' }]
});
import requests
requests.post(
"https://spitshake.io/api/submissions",
headers={"X-Auth-Token": os.environ["SPITSHAKE_KEY"]},
json={
"template_id": 42,
"submitters": [{"role": "Signer", "email": "ada@acme.com"}]
}
)
import { SpitShakeForm } from '@spitshake/react';
export function SignContract({ token }) {
return <SpitShakeForm token={token} onComplete={handleDone} />;
}
SDKs & integrations
Meet your stack where it lives.
Pricing
Flat per-submission. No sales calls.
Pay for submissions, not seats. Start free, scale with usage, annual plans save 20%.
Starter
Indie SaaS + agencies
$39/ month
200 submissions · $0.50 overage
- Full REST API + every SDK
- AI field detection
- Remove SpitShake branding
- Zapier, n8n, webhooks
Growth
Growing SaaS + teams
$149/ month
1,000 submissions · $0.30 overage
- Everything in Starter +
- KBA + SMS verification
- Signer delegation + witness
- Priority Slack support
Business
Scaling teams w/ SSO
$399/ month
5,000 submissions · $0.20 overage
- Everything in Growth +
- SSO (SAML) + SCIM
- 99.95% uptime SLA
- Dedicated account manager
Free tier (25 submissions/mo), pay-as-you-go ($0.75/submission), and Enterprise available. See full pricing + compare plans →
Security & compliance
Audit-ready from day one.
HIPAA-ready with BAA support, SOC 2 controls, AES-256 at rest, immutable SHA-256 chain audit trails, TSA timestamping, organization-wide MFA enforcement, and IP allowlisting.
Read the security docsHIPAA
Ready + BAA
SOC 2
Controls
AES-256
At rest
SHA-256
Chain audit
MFA
Enforced
TSA
Timestamps
Ship your signing flow
this afternoon.
Create a template, embed the form, fire a webhook. The first submission takes five minutes.