Assinafy -- WordPress 插件

开发者	assinafy
更新时间	2026年10月20日 02:38
PHP版本:	8.2 及以上
WordPress版本:	7.1
版权:	GPL-2.0-or-later
版权网址:	版权信息

Assinafy connects your WordPress site to the Assinafy electronic signature service. Choose a PDF you have already uploaded, name the people who must sign it, and send it for signature without leaving the admin. Each request stays on record inside WordPress, and its status is kept current until the document is signed and certified. An Assinafy account is required. Connect your production workspace with OAuth from the settings screen. Existing API keys continue to work, and the sandbox still uses an API key. What it does

Send any PDF in the media library for signature, with a message and a deadline.
Invite as many signers as you need, each with a name, an email address and an optional WhatsApp number.
Control the order: signers sharing a number are invited together, a higher number waits for every lower number to sign.
Track each request as its own record under Assinafy → Documents, with a status badge and a per-signer progress line.
Copy the signing link for any signer who has already been invited.
Resend an invitation, move the deadline, rename the document before it is sent, or cancel the request.
Download the original PDF, the signed PDF, the signature certificate page, the PAdES file and the complete bundle. Downloads are proxied through WordPress behind a capability check, so no Assinafy URL is ever exposed to a browser.
Keep status current automatically: Assinafy can notify this site over a webhook, and an hourly background job reconciles anything a webhook missed.
Three roles' worth of access control: separate capabilities to send, to manage and to view signature requests.
Optional WooCommerce integration: attach a PDF to a product and the customer is asked to sign it when their order is completed. The order gets a note either way.
Optional Elementor Pro Forms action: send an existing local PDF to a mapped name/email signer. Development adapter: documented API contract tests pass; licensed Pro runtime validation is pending.
WP-CLI: wp assinafy status, send, sync and webhook.
Privacy tools: the WordPress personal data exporter reports a person's signature requests, and the eraser redacts their name, address and signing link while retaining the signature evidence.

Form integrations The source repository also contains separate development add-ons for Gravity Forms, Contact Form 7 and WPForms. They are not bundled in this core ZIP. Each provides an existing-PDF workflow; none generates contracts or requires payment. CF7 and WPForms Lite have real-host tests. Gravity Forms, Elementor Pro and WPForms Pro still require licensed-host validation. See README.en.md and docs/integrations.en.md in that repository for exact scope and setup. Sending from your own code Any form plugin, theme or custom integration can send a document by firing one action:

do_action( 'assinafy_send_document', array( 'attachment_id' => 123, 'signers'       => array( array( 'name' => 'Jane Doe', 'email' => 'jane@example.com' ) ), ) );

Use assinafy_send_document_async for the same thing on a scheduled event. Status changes fire assinafy_document_status_changed, plus assinafy_document_certificated, _rejected, _expired and _failed. Verification methods Assinafy offers four, and a signer uses one of them:

Email (the default) — the signer receives a one-time code by email. No credits.
WhatsApp — the code arrives over WhatsApp. Requires a phone number and a paid Assinafy plan.
Digital certificate — the signer signs with their own ICP-Brasil certificate. Requires a virtual assignment, the Digital Certificate feature on the Assinafy account, and the signer must be alone in their signing step. Collect and template certificate requests are rejected before they can be charged or invited.
Biometric — IdDocumentFaceMatchBasic uses government ID photos and a liveness check on Assinafy's hosted page with explicit signer consent. Requires the account feature and an existing signer with a valid CPF. Certification waits for account approval if identity review is required.

The send screen and WP-CLI send command use email verification. All four methods are available to code that calls the assinafy_send_document action or shared send service. DigitalCertificate covers A1 and A3. Certificates and biometric verification allow either Email or WhatsApp notifications. Signing happens on Assinafy's own hosted pages, not inside WordPress. This plugin composes the request, stores the document and assignment identifiers, and fetches status and files back.

安装:

In wp-admin go to Plugins → Add New, search for Assinafy, then install and activate. To install manually, upload the plugin folder to wp-content/plugins/ and activate it from the Plugins screen.
Create a free account at assinafy.com.br and use an HTTPS WordPress admin page.
In wp-admin open Assinafy → Settings, choose Production, and press Connect Assinafy. Approve access in the new tab, then copy the displayed code into the original WordPress settings tab within 60 seconds. The plugin selects the workspace you approved.
For Sandbox, choose Sandbox and enter its account id and API key. Existing production API-key connections continue to work until you connect with OAuth.
Press Register this site with Assinafy to receive status updates over a webhook. This is optional: status is reconciled hourly regardless.
Set a default deadline and an optional default message, and choose which capability is allowed to send.

Activation grants administrators all three Assinafy capabilities, editors send and view, and authors view; registers the Documents post type; generates the webhook token; and schedules the hourly reconcile job. Nothing is deleted on deactivation. For a legacy or sandbox API-key connection, you may define credentials in wp-config.php: define( 'ASSINAFY_ACCOUNT_ID', '...' ); define( 'ASSINAFY_API_KEY', '...' ); Otherwise the API key is stored encrypted, and the settings field never renders it back to the browser. OAuth access and refresh tokens are also encrypted in WordPress; you can disconnect from the settings screen. New stored credentials require unique WordPress security keys and salts in wp-config.php, or a random ASSINAFY_ENCRYPTION_KEY constant. WordPress-generated database salts alone cannot protect credentials in a database backup. Existing credentials remain readable; if you add a new encryption key, reconnect Assinafy or re-enter the API key. If the site sends HTTP requests through a proxy (WP_PROXY_HOST in wp-config.php), Assinafy requests need the PHP cURL extension: without it, WordPress cannot carry HTTPS through the proxy securely, so the plugin refuses the request. Enable cURL, or add api.assinafy.com.br (and sandbox.assinafy.com.br for Sandbox) to WP_PROXY_BYPASS_HOSTS.

常见问题:

更新日志:

1.4.2

Requires virtual assignments for digital-certificate signers and rejects collect or template certificate requests before estimating cost or requesting signatures.
Includes Assinafy PHP SDK 2.7.1.

1.4.1

Prevents local document records from being used with a different Assinafy workspace or API environment.
Keeps privacy erasure safe during synchronization and includes pending asynchronous sends in WordPress privacy tools.
Prevents older API responses and local storage failures from silently corrupting document progress.
Rejects duplicate resolved signers and reports failed local cleanup after remote cancellation.

1.4.0

Adds biometric verification, Email/WhatsApp notifications for identity methods, and identity-review status updates.
Stores signing secrets returned at webhook creation, including for OAuth, and refuses deliveries with an unreadable secret.
Fixes workspace/signer authentication and protects foreign webhook endpoints from stale stored IDs.
Includes Assinafy PHP SDK 2.7.0.

1.3.1

Disconnecting OAuth after an interrupted token refresh again asks you to revoke the app in Assinafy Connected Apps, because that grant may still be active.

1.3.0

Webhook deliveries are signed (Standard Webhooks): registration manages this site's own endpoint with signing enabled, and unsigned or stale deliveries are refused once a secret is configured — stored automatically on API-key sites, pasted from the Assinafy dashboard on OAuth sites.
Registering the webhook no longer replaces another integration's endpoint; each site manages its own (accounts support up to three endpoints on paid plans).
Updates the bundled Assinafy SDK to 2.6.2.
The signature deadline must be at least one hour in the future, matching the API's rule.
A rate-limited OAuth token refresh no longer disconnects the site.
Fixes the rename action's availability, signer names in document activities, and the deletable-status fallback after an API outage.

1.2.1

Security: updates development dependencies to fix the proxy-addr advisory.

1.2.0

After a document is sent, the confirmation appears on its document screen.
wp assinafy webhook off asks before stopping deliveries to an endpoint that belongs to another site or integration; --yes answers the prompt.
WooCommerce orders whose personal data was erased are not sent for signature.
Starting or completing an OAuth connection reports the specific reason OAuth is unavailable.
Webhook documentation describes accounts with up to three endpoints on paid plans; the plugin manages the account's oldest endpoint.

1.1.3

Fixes OAuth token requests, document sending, and signer validation.
Includes complete SDK and API references.

1.1.2

OAuth connections stay active while they are used: every refresh returns a refresh token valid for another 30 days, so a connection ends only after 30 days without a refresh.
A refresh token that may already have been used is never sent again; the plugin asks you to reconnect instead. An API 401 refreshes once and resends the request.
Disconnect and uninstall revoke the latest token, and uninstall revokes the connection before deleting it.
Without cURL, requests to Assinafy use TLS 1.2 and are refused through an HTTP proxy that cannot tunnel HTTPS.
Assinafy PHP SDK 2.4.2.

1.1.1

The plugin's own HTTPS requests to Assinafy now require TLS 1.2 or newer; TLS 1.0 and 1.1 connections are refused. Other HTTP requests on the site are unchanged.

1.1.0

Adds OAuth connection for production WordPress sites, with encrypted rotating tokens, a dedicated callback and disconnect control.
Existing API-key connections continue to work; Sandbox still uses an API key.

1.0.1

Translations are delivered as wordpress.org language packs.
Fixes across sending, webhooks, multisite, privacy and WooCommerce. CHANGELOG.md has the full list.

1.0.0

First release.

Assinafy

标签

下载

详情介绍:

安装:

升级注意事项:

常见问题:

更新日志: