pesign-cli 0.1.0

Command-line client for the PESIGN PDF signing API

PESIGN CLI

Command-line client for the PESIGN PDF signing API.

PESIGN allows users to securely sign PDF documents through a hosted PESIGN API. The CLI is installed locally and communicates with the remote API over HTTPS.

The GlobalSign DSS credentials and mTLS certificate/key stay on the server. Users only need PESIGN-generated API keys and secrets.

Features

• Check PESIGN API health
• Sign PDF files
• Create user signing API keys
• List signing API keys
• Revoke signing API keys
• Create admin keys
• List admin keys
• Revoke admin keys
• Admin-only user creation
• Admin-only user listing
• Admin-only user deletion

Requirements

• Python 3.11 or newer
• Access to a running PESIGN API server
• Valid PESIGN user credentials or API credentials

Installation

Install from package

pip install pesign-cli

Install locally for development

From inside the pesign-cli folder:

pip install -e .

After installation, confirm the CLI is available:

pesign --help

Configuration

Create a .env file in the folder where you run the CLI.

Example:

PESIGN_API_URL=https://pesign.christnd.codes

You can also pass the API URL directly with:

--api-url https://pesign.christnd.codes

Authentication

PESIGN uses different credentials depending on the action.

Signing API credentials

Used for signing PDFs:

pe_ak_...
pe_sk_...

The API key is passed as an option. The secret is prompted securely.

User password

Used for:

• Creating API keys
• Listing API keys
• Revoking API keys
• Creating admin keys
• Listing admin keys
• Revoking admin keys

The password is prompted securely.

Admin key credentials

Used for admin actions:

pe_admin_ak_...
pe_admin_sk_...

Admin keys are required for:

• Creating users
• Listing users
• Deleting users

The admin key is passed as an option. The admin secret is prompted securely.

Commands

Health check

pesign health

With explicit API URL:

pesign health --api-url https://pesign.christnd.codes

Sign a PDF

pesign sign input.pdf signed.pdf \
  --api-key "YOUR_API_KEY" \
  --reason "Approved contract" \
  --location "Paris, FR" \
  --name "C.ND" \
  --overwrite

The CLI will prompt for:

API Secret:

Windows PowerShell example

pesign sign .\input.pdf .\signed.pdf `
  --api-key "YOUR_API_KEY" `
  --reason "Approved contract" `
  --location "Paris, FR" `
  --name "C.ND" `
  --overwrite

Create a signing API key

pesign create-api-key \
  --user username \
  --name "Test signing key"

The CLI will prompt for the user's password. The API secret is shown only once. Store it securely.

List signing API keys

pesign list-api-keys --user username

The CLI will prompt for the user's password. The output includes copyable API key IDs. Use the ID when revoking a key.

Revoke a signing API key

pesign revoke-api-key \
  --user username \
  --id "API_KEY_ID"

Example:

pesign revoke-api-key \
  --user username \
  --id "f63da227-8c29-44a8-a81f-2127190c6f5c"

The CLI will prompt for the user's password.

Create an admin key

pesign create-admin-key \
  --user username \
  --name "ND temporary admin key"

The CLI will prompt for the admin user's password. Admin keys are short-lived and should be stored securely.

List admin keys

pesign list-admin-keys --user username

The CLI will prompt for the admin user's password. The output includes copyable admin key IDs. Use the ID when revoking an admin key.

Revoke an admin key

pesign revoke-admin-key \
  --user username \
  --id "ADMIN_KEY_ID"

Example:

pesign revoke-admin-key \
  --user username \
  --id "eb6ccb9c-bc7b-443f-b95d-c4a42f254e71"

The CLI will prompt for the admin user's password.

Create a user

Requires an active admin key.

pesign create-user john \
  --role signer \
  --api-key-name "John first signing key" \
  --admin-key "pe_admin_ak_YOUR_ADMIN_KEY"

The CLI will prompt for:

Admin Secret:
Password:
Confirm password:

Allowed roles are usually:

admin
signer
viewer

The created user's first API secret is shown only once. Store it securely.

List users

Requires an active admin key.

pesign list-users \
  --admin-key "YOUR_ADMIN_KEY"

The CLI will prompt for:

Admin Secret:

Delete a user

Requires an active admin key.

pesign delete-user john \
  --admin-key "YOUR_ADMIN_KEY"

The CLI will prompt for:

Admin Secret:

Common Options

Most commands support:

--api-url

Example:

pesign health --api-url https://pesign.christnd.codes

Some commands also support timeout options depending on the installed CLI version:

--timeout 60

Environment Variables

Variable	Required	Description
PESIGN_API_URL	Recommended	Default PESIGN API URL
PESIGN_CF_ACCESS_CLIENT_ID	Optional	Cloudflare Access client ID
PESIGN_CF_ACCESS_CLIENT_SECRET	Optional	Cloudflare Access client secret

Example .env:

PESIGN_API_URL=https://pesign.christnd.codes

Troubleshooting

pesign command not found

Make sure the package is installed in the active Python environment:

pip show pesign-cli

On Windows:

where pesign

Inside a virtual environment, the command should usually point to:

.venv\Scripts\pesign.exe

API not reachable

Check:

pesign health --api-url https://pesign.christnd.codes

Also confirm the server health endpoint works:

curl https://pesign.christnd.codes/v1/health

Invalid API credentials

Confirm that you are using:

X-PESIGN-API-Key     -> pe_ak_...
X-PESIGN-API-Secret  -> pe_sk_...

For signing, do not use admin keys.

Invalid admin credentials

Confirm that you are using:

X-PESIGN-Admin-Key     -> pe_admin_ak_...
X-PESIGN-Admin-Secret  -> pe_admin_sk_...

Admin keys may expire and may need to be regenerated.

Development

Install in editable mode:

pip install -e .

Run:

pesign --help

Build package:

python -m build

Check package:

twine check dist/*

Install built wheel:

pip install dist/pesign_cli-0.1.0-py3-none-any.whl

License

Proprietary.

All rights reserved.