Automating Electronic Signatures with n8n (Yousign)

A French SME that sends its quotes as a PDF attachment loses, on average, several days between sending and signature — the time it takes for the document to be printed, signed by hand, scanned, and emailed back. Electronic signature fixes that problem on the client-facing side. But on the internal process side, it almost always leaves the same gap paper did: nobody follows up automatically with a silent recipient, nobody consistently archives the signed document in the right place, nobody updates the CRM at the exact moment the contract becomes effective. That's the gap n8n fills, by connecting Yousign — the French electronic signature provider, hosted in France and eIDAS-qualified by ANSSI — to the rest of your tool stack.

Why Yousign over another provider

The technical principle of an electronic signature integration is the same with every serious provider: create a request, get notified of its status, retrieve the signed document. What sets Yousign apart, for an organization handling contracts in France or Europe, is hosting: documents and signature evidence stay in France and the European Union, while some US competitors route the same data through infrastructure subject to the Cloud Act. Yousign is also ISO 27001 and SOC 2 certified, and qualified by ANSSI as a trust service provider under the eIDAS regulation — a status that matters as soon as GDPR compliance or data sovereignty is part of the requirements, for example to complete your GDPR records of processing.

No reliable native node: use the API v3

Unlike Gmail or Slack, Yousign isn't part of n8n's core integrations. A community node exists (n8n-nodes-yousign), but it has barely evolved since its initial release and doesn't cover the recent features of the API v3 — a risk in production, as with any unaudited community node. The robust method, working identically in self-hosted setups and on n8n Cloud, is to call Yousign's REST API v3 directly with an HTTP Request node.

On authentication, Yousign is noticeably simpler than most e-signature providers: a single API key generated from the developer dashboard is enough, passed as an Authorization: Bearer header. No JWT to sign, no OAuth2 exchange to orchestrate. Store that key in an n8n HTTP Header Auth credential rather than in plain text inside a node — see our n8n environment variables guide for the same logic applied to self-hosted instances.

The workflow architecture

The full pipeline comes down to five steps:

1. Trigger — an approved quote in an n8n Data Table, a CRM webhook, or directly the continuation of our PDF quote generation guide: the document to be signed already comes out of that first workflow.
2. Signature request creation — an HTTP Request POST /signature_requests initializes the procedure (name, message), followed by a POST /signature_requests/{id}/documents call that uploads the PDF, then a POST /signature_requests/{id}/signers call for each recipient with a signature field placed via a text anchor (a phrase in the document, more reliable than a fixed x/y coordinate if the template changes).
3. Activation — a POST /signature_requests/{id}/activate call moves the request from draft to ongoing and triggers immediate delivery of the signature email; the workflow saves the request ID in a tracking table (Supabase or Data Table), with its initial status.
4. Real-time status webhook — configured once in the Yousign dashboard, it notifies an n8n Webhook on every status change: signature_request.activated, .done (all signers have signed), .expired, .reactivated, .reminder_executed. The workflow updates the tracking table and, on .done, triggers archiving.
5. Retrieval and archiving — a download of the signed document (with the embedded proof certificate) archives it to Google Drive or Supabase Storage, then updates the CRM via our HubSpot/Pipedrive sync guide and notifies the team on Slack.

Why the webhook changes everything

Without a webhook, you'd have to poll each signature request's status periodically — which multiplies API calls and introduces a delay between the actual signature and the workflow reacting to it. Yousign pushes the event in real time as soon as the last signer confirms their signature: the workflow reacts within seconds, which matters especially when invoicing or a delivery depends on that exact moment — the same stake as tracking contract deadlines.

Securing the Yousign webhook

Yousign signs every notification with a shared HMAC SHA-256 key, sent in the X-Yousign-Signature-256 header. As with any publicly exposed webhook, you need to recompute that hash on the n8n side from the raw request body and compare it before processing the payload — our n8n webhook security guide walks through exactly this verification. It's essential here: a forged signature_request.done event could wrongly trigger the archiving of an unsigned contract or the start of invoicing.

Automatic reminders and expired requests

A signer who hasn't opened the signature link within 48 hours is a common case, not an edge case. Yousign natively handles scheduled reminders (the signature_request.reminder_executed event confirms they were sent), but nothing prevents triggering an additional manual follow-up — a notification to the sales team rather than a plain automated email — following the same principle as our article on following up on incomplete files. Conversely, a request that reaches expired status should surface immediately so the team can decide whether to restart the procedure or close it out.

What legal weight does the resulting signature carry

The eIDAS regulation distinguishes three levels: simple electronic signature (the default obtained with this workflow), advanced, and qualified — only the latter carrying a presumption of reliability equivalent to a handwritten signature. Yousign covers all three levels and is qualified by ANSSI as a trust service provider under eIDAS, which lets you enable qualified signature for documents with high legal stakes without switching providers. A study by Ege, Çağal, and Bıçakcı, Usability of Token-based and Remote Electronic Signatures: A User Experience Study (2025 — see on Google Scholar), compared the user experience of remote signatures (the standard Yousign model) to hardware token-based signatures, typical of the qualified level: remote signatures are perceived as significantly more usable, with no installation or dedicated hardware, while tokens inspire more confidence on perceived security. This trade-off explains why simple signature dominates routine business use (quotes, contracts, purchase orders), while qualified signature stays reserved for documents that genuinely require it — a call to make with a lawyer case by case, not a default technical choice.

Going further

Automating the sending, tracking, and archiving of Yousign signatures closes the loop opened by quote and electronic invoice generation: the document isn't just produced anymore, it's sent, signed, and filed with no manual step, with timestamped proof at every stage. This automation fits naturally into the audit trail of the Compliance & Audit Pack (€149), which already logs every action to Supabase — each Yousign request's status can be recorded there alongside everything else. And if your needs also cover sorting the inbox or a RAG-powered document assistant, the Complete FlowKit Bundle (€269 instead of €347) brings all three packs together on a shared base.