Embed events

When you embed the signing UI, the iframe shows a dedicated success experience after the signer signs, and can notify your page via a postMessage event.

Iframe events vs backend

Use iframe events only for visual UI flow (e.g. closing the iframe, navigating, showing a confirmation). Backend-side management such as downloading the signed document or audit proof should happen server-side via webhooks (e.g. when you receive ENVELOPE_SIGNED or ENVELOPE_COMPLETED).

Success modal in the embed

After the signer completes signing, the embed shows a success modal that does not promote account creation. It offers:

• Download signed document - Shown only when the envelope is fully completed (all signers have signed). The signer can download the signed PDF from the modal.
• Go back to view the document - Closes the modal. Your host page can listen for the subnoto:documentSigned event (see below) to close the iframe, navigate, or refresh.

postMessage when the document is signed

When the signer completes signing, the iframe posts a message to the parent window so your app can react (e.g. close the iframe, show a confirmation, or navigate).

Message format

• event.data.type: "subnoto:documentSigned"
• event.data.payload:
  • envelopeUuid (string) - The envelope that was signed
  • completed (boolean) - true when the envelope is fully completed (all signers have signed)
  • workspaceUuid (string, optional) - The workspace that owns the envelope

Listening for the event

In your host page (the one that contains the iframe), add a message listener:

window.addEventListener("message", (event) => {
    if (event.data?.type === "subnoto:documentSigned") {
        const { envelopeUuid, completed, workspaceUuid } = event.data.payload;
        // e.g. close the iframe, navigate, or show a success message
    }
});

Security

The embed sends the message with targetOrigin: "*". You should always verify event.origin in your listener before trusting the message. In production the embed is served from https://app.subnoto.com (or your custom embed domain). Reject messages from any other origin:

const EMBED_ORIGIN = "https://app.subnoto.com"; // production; use your custom embed domain if applicable

window.addEventListener("message", (event) => {
    if (event.origin !== EMBED_ORIGIN) return;
    if (event.data?.type === "subnoto:documentSigned") {
        const { envelopeUuid, completed } = event.data.payload;
        // handle signed event
    }
});

Next steps

Get started

Vanilla / HTML

Webhooks