Trusted Signatures Publisher CLI

CLI Quickstart

Use the CLI when your team wants the fastest path from PDF generation to Acrobat-verifiable trust.

1. Install

1
2
3

curl -LO https://trusted-signatures.com/downloads/sign-pdf-v1.2.3-macos-arm64.tar.gz
tar -xzf sign-pdf-v1.2.3-macos-arm64.tar.gz
sudo mv sign-pdf /usr/local/bin

2. Set credentials

1
2

export TS_API_KEY_ID="<your-key-id>"
export TS_API_KEY="<your-key-hex>"

3. Seal a PDF

1
2
3
4
5

sign-pdf \
  --input input.pdf \
  --output signed.pdf \
  --apikeyid "$TS_API_KEY_ID" \
  --apikey "$TS_API_KEY"

4. Expected outcome

• signed.pdf opens in Acrobat/Reader with trusted signature metadata.
• Any unauthorized edits are flagged as invalid.

Useful flags

• --ltv: embed long-term validation data
• --tsa: embed trusted timestamp
• --limit-changes <policy>: enforce post-seal change policy
• --endpoint: override API endpoint

Security notes

• Only SHA-256 digest is sent to Trusted Signatures API.
• Private document contents and metadata stay local.
• Ensure machine clock is accurate for HMAC auth.

Next steps

• Need API-level control? Use API quickstart.
• Need enterprise rollout planning? Book demo.