Document e-Sign Kit
A self-hosted e-signature core for Laravel: per-signer magic-link click-to-sign plus a hash-chained, tamper-evident audit trail you can re-verify. No third-party provider.
Why This Exists
Define a document, add signers, and send each a per-signer magic link. When a signer clicks through and consents, the package appends a hash-chained audit event — each event commits to the one before it, so altering, inserting, deleting, or reordering any event (or editing a signer's IP, user-agent, or signature value) breaks the recomputed chain, which verify() detects and pinpoints. It is a self-hosted signing CORE: no sealed-PDF/PAdES output, no third-party provider, and it is not a certified ESIGN/UETA/eIDAS product — you own your legal requirements.
Features
Hash-Chained Audit Trail
Each event commits to the last; verify() pinpoints any tampering
Magic-Link Signing
Per-signer tokenized, single-use, expiring click-to-sign
Fully Self-Hosted
Truth is your own database — no DocuSign, no third-party calls
Signer Forensics
IP, user-agent, and signature value are covered by the chain
What You Get
How It Works
Create + Send
Define the document and its signers; each signer gets a tokenized magic link on your domain.
Click to Sign
The signer opens their link, consents, and signs. The token is single-use and expiring; a used or expired link cannot sign again.
Chain the Event
Each action appends a hash-chained event that commits to the document hash, the signer's IP/user-agent, the signature value, and the previous event.
Verify Any Time
Re-run verify() to confirm nothing was altered — it reports ok plus the exact sequence where a broken chain, edited body, or swapped signature was found.
Technical Details
SHA-256 over each event's canonical fields + ip + user-agent + prev hash (chain version esign-chain-v2). The signed event also commits the signature value's hash; verify() re-derives and compares it.
256-bit random tokens stored only as SHA-256, per-signer scoped, expiring, and single-use — a used/expired token cannot re-sign.
No platform/HMAC/mesh and no hard user dependency — an OwnerResolver seam or a plain nullable owner_id. Chain appends are serialized under a row lock.
No sealed-PDF/PAdES output (audit trail only), no DocuSign/third-party provider, no identity verification beyond email-link possession + an optional typed/drawn mark.
Frequently Asked Questions
Document e-Sign Kit
A self-hosted e-signature core for Laravel: per-signer magic-link click-to-sign plus a hash-chained, tamper-evident audit trail you can re-verify. No third-party provider.
This product isn't available for purchase yet.
Item Details
We build the tools we sell. Every product is extracted from our own production systems.
Book a call for custom workMore from Blorp Blorp Market
AI Contact Form
An intelligent contact form that qualifies leads, blocks spam, and drafts responses — powered by your own OpenAI key.
Resilient LLM Router
A multi-provider LLM client with automatic failover and one consistent JSON schema across Groq, Gemini, OpenAI, and Anthropic — powered by your own keys.
Creator Affiliate Storefronts
A multi-tenant, keyed Amazon affiliate platform — your site earns on the house tag while each approved creator earns on their own. Drop-in Laravel, bring your own Associates tags.
Embeddable AI Chatbot Widget
A one-script embeddable AI chat widget with a bring-your-own-key Laravel backend. Your OpenAI/Anthropic key stays on your server.
AI Citation Verifier
Submit claims with the source URLs that back them; each source is fetched behind an SSRF guard and graded by an LLM as Supports / Partially / Contradicts / Irrelevant. Bring your own key.
Project Scope Estimator
A deterministic, multi-step project scope + price/time estimator with optional lead capture. Ships as both a Laravel package and a self-contained vanilla-JS widget. No AI required.
LLMO / llms.txt Kit
Generate a correct llms.txt and AI-crawler robots groups for your site, plus a heuristic LLM-readiness report. SSRF-guarded, bring-your-own-key optional copywriting.
Playful Bot-Gate
A friendly mini-game human check for your forms — the answer is verified server-side and a single-use signed token gates the submit. A novelty/engagement gate, not a security wall.
Brand Palette + WCAG Contrast Utility
A pure-PHP utility that computes WCAG contrast ratios from your brand colors and tells you which pairings pass AA / AAA — with accessible pairing suggestions. No AI, no network.
Styled QR Generator
A stateless engine that renders branded SVG QR codes — module styles, frames, gradients, and an embedded logo — with pluggable payload encoders (url / wifi / vcard / geo / text).
Occupancy / Capacity Counter
A concurrency-safe, append-only manual headcount ledger — lock-safe in/out events, zero-clamped, that warns then flags when a configurable capacity is exceeded. Counts people without identifying them.
Credential Expiry Roster
A roster report that buckets worker credentials into EXPIRED / EXPIRING-SOON / UNDATED (an undated credential is a gap, not "fine"). Records operator attestation — it does not verify credentials against any issuer.
Laravel Calculator Suite
A headless pack of 27 real, working calculators (financial, health, home, utility) behind one BaseCalculator contract, a pure-PHP registry, and a sanitized /calculate JSON endpoint. Estimates only — every one ships a disclaimer.
Need This Customized?
We built this product. We can customize it for your specific needs, integrate it with your systems, or build something entirely new.