Partner Signer — Overview
Partner Signer is for ISVs who want their own clients to sign locally TEIF invoices with their TunTrust smart card (PKCS#11/USB), through the local FatooraSigner agent — without ever handling the PIN or transmitting it to your servers.
Unlike Partner API, there is no client-facing consent step: you, the partner, directly pre-register your clients' tax IDs, based on your own existing relationship with them.
The parties involved
- You (the Partner Application) — an ISV embedding a signing UI into your own web app.
- Fatoora Cloud (
business.fatoora.tn) — issues end-client JWTs and validates every signing session against your domain whitelist and pre-registered client list. - FatooraSigner — the local agent installed on the end client's machine. It talks to the PKCS#11 token directly, and to Fatoora Cloud for session validation — never to your servers.
- The end client — the person actually signing, using their own TunTrust smart card.
- TTN — the local FatooraSigner agent can file signed invoices with TTN directly (see Authentication and signing) — a capability Partner API doesn't expose.
Key principles
- No OTP step. You pre-register a client's tax ID yourself (
POST /api/partner/signer/clients) — Fatoora doesn't ask the client to approve. You're responsible for having your own agreement with each client before pre-registering them. - The PIN never leaves the client's machine. It's sent directly from the browser to
127.0.0.1:38443, encrypted in-memory for the session's lifetime, never transmitted to Fatoora Cloud or your servers. - Domain whitelisting protects the cloud-side session check, not the local agent's CORS policy — two separate layers, detailed in Authentication and signing.
Workflow
| Step | Actor | Action |
|---|---|---|
| 1 | Client | Creates a Fatoora account |
| 2 | Partner → Fatoora | Whitelists its web app's domain (once) |
| 3 | Partner → Fatoora | Pre-registers the client's tax ID (no client action needed) |
| 4 | Client → Fatoora | Logs in, gets a short-lived JWT |
| 5 | Client → FatooraSigner | Opens a local bridge session (JWT + partner app id) |
| 6 | FatooraSigner → Fatoora | Validates the session (domain + pre-registered tax ID) |
| 7 | Client → FatooraSigner | Signs the TEIF invoice with the local PKCS#11 PIN |
| 8 | Partner → Fatoora | Can list its pre-registered clients & domains anytime |
Onboarding
Step 1 — Register
POST /api/partner/register
{ "partnerType": "signer", "companyName": "...", "contactEmail": "..." }
Provisions a clientId + client secret (same mechanism as Partner API). Your account starts pending_verification.
Signer partners are never listed in the public catalog — your clients already reach you through your own product, not Fatoora.
If your product also needs a classic API integration, register with partnerType: "both" to unlock both offerings.
Step 2 — Whitelist your domains
POST /api/partner/signer/domains { "domain": "yourapp.example.com" }
domain must be a bare hostname (no scheme). Capped at maxAllowedDomains for your plan (1 for partner-signer, 5 for partner-signer-pro).
Step 3 — Pre-register your clients
POST /api/partner/signer/clients { "taxId": "1234567ABC000", "clientName": "Client SARL" }
POST /api/partner/signer/clients/bulk { "clients": [...] }
Capped at maxSignerClients for your plan (50 for partner-signer, 300 for partner-signer-pro).
Once a tax ID is pre-registered and active, and the browser is on a whitelisted domain, the client can open a signing session immediately.
Full endpoint reference: Domain and client management.