Quickstart

The Python SDK hashes the file locally with SHA-384 (96 hex characters) and registers that seal. The file stays on the device until you send or share it.

Python 3.10 or newer. Hash the file locally, then make the three calls in the API contract.

pip install hashsign-python

from hashsign import HashSignClient
from hashsign.crypto import sha384_file

# sha384_file returns SHA-384 as 96 hexadecimal characters.
digest = sha384_file("contract.pdf")

client = HashSignClient(api_key="hs_live_...")
document = client.documents.upload("contract.pdf")
signed = client.documents.sign(document.id)
proof = client.documents.verify(document.id)
print(document.sha384)

upload posts JSON. It does not upload the file bytes. The sha384 field is the 96-character hex digest:

{
  "fileName": "contract.pdf",
  "mimeType": "application/pdf",
  "sizeBytes": 48211,
  "sha384": "<96 hex characters>"
}

Only that seal is anchored. Optional cloud review with HashSign AI runs only when you trigger it.

The SDK default base URL in this repository is https://api.hashsign.io/v1. Pass base_url to point at another origin, including http://localhost:3000/api/v1 for the local portal. Pass pqc_mode=True to request the hybrid ECDSA P-256 and ML-DSA-65 envelope. The SDK does not bundle a lattice library.

A hash shows a document has not changed since it was sealed. It does not prove who signed it.