Arabic e-signature API: what to check

Right-to-left interface, mixed Arabic and Latin text, Arabic PDFs, emails, dates and evidence: a checklist for choosing an Arabic e-signature API.

Published Oct 3, 2026 · 8 min read

An Arabic e-signature API is more than translated labels. If your software serves users in the Gulf or Morocco, check that the signer journey is fully right-to-left, that names and amounts mixed with Latin text display correctly, that Arabic PDFs stay intact, and that each signer gets their link in their own language.

This guide lists what to test before you pick a provider, then shows how Khatm handles each point: a native Arabic, French and English signer journey, a REST API v1 you can try in the sandbox, and a production setup prepared with you.

The checklist at a glance

The most reliable test is to send a real document from your product, such as an employment contract written in Arabic in your HR software or a bilingual quote generated by your CRM, to a test signer, then review every screen and the final PDF.

A signing interface that is truly right-to-left

Arabic pages read from right to left as a whole. Translating strings is not enough: the structure of the interface has to be mirrored. A signer in Riyadh or Casablanca notices at once when a page has Arabic words but a Western visual logic.

• The page declares right-to-left direction (dir="rtl") and the Arabic language, for the browser and for screen readers.
• Next and back arrows, progress bars and menus are mirrored.
• Inputs, checkboxes and error messages sit on the correct side.
• The interface font covers Arabic at a readable size on mobile, where most signing happens.
• Elements that should not flip, such as the PDF itself or a logo, stay as they are.

Mixed Arabic and Latin text

In a real signing flow, Arabic always sits next to Latin text: an email address, a contract number, a company name in English, an amount followed by SAR or MAD. The Unicode bidirectional algorithm handles these mixes, but only when the interface isolates each fragment properly.

• An Arabic name followed by a Latin email keeps the right order, with no bracket or full stop jumping to the other end of the line.
• References such as HR-2026-0042 display exactly as entered.
• Amounts keep the currency on the expected side with the expected separators.
• Signer names your product sends in Arabic are kept as they are in the interface, the emails and the evidence.

To test, prepare a deliberately awkward data set: one Arabic name, one French name, an email, a reference with hyphens and an amount. If these five values survive every screen, you have covered most real cases.

Arabic PDFs: fonts and field placement

Your software produces the PDF, so your document generator is responsible for embedding complete Arabic fonts and handling contextual letter forms and ligatures such as lam-alef. A well-generated PDF looks the same in every viewer; a PDF that relies on a font missing from the signer’s device can show isolated letters or empty boxes.

The signing service has to sign that PDF without rewriting it. With a PAdES signature, any change to the content after signing invalidates the signature. That is a useful guarantee, provided the service leaves your layout untouched. Inside a PAdES signed PDF

Field placement also needs attention. In an Arabic contract, the signature block and the date line are not always where they sit in the English version. Check that you can place fields by coordinates or through a template, and review any automatic suggestion before confirming it.

Emails, links and each signer’s language

One request often brings together signers who speak different languages: an employee who signs in Arabic, an HR manager who prefers French, a foreign partner in English. Language should be set per signer, not for the whole request.

• The signing page opens in the language chosen for that signer, instead of depending on browser settings.
• The invitation subject and body use the same language, with a right-to-left layout for Arabic.
• Reminders follow the same rule as the invitation.
• Emails carry your brand: sender name, custom message and logo, and state that they are sent on your behalf.
• If your product sends its own notifications, the API returns the signing link so you can use it in your own templates.

Dates, digits and formats

Conventions vary by country. In Morocco, Western digits (0 to 9) are the norm; in the Gulf, Eastern Arabic digits (٠ to ٩) remain common in some contexts. The Hijri calendar appears in administrative documents in Saudi Arabia. Before choosing a provider, check:

• the date format shown to the signer and written into the PDF and the evidence;
• the time zone used for event timestamps;
• which digits the Arabic interface uses;
• how your own documents present Hijri dates, if your business needs them, since those dates belong to the content of your PDF.

Evidence your teams can read

When a contract is disputed, your legal or support team, often Arabic-speaking, opens the file. Check that the evidence report reads well in their language, that Arabic names appear correctly, and that the structured data can be processed by your own tools.

How it works with Khatm

Khatm builds PDF signing into your software, under your brand, in Arabic, French and English. The signer journey is designed natively in all three languages, with a right-to-left interface for Arabic. The same engine is available through the web platform, with no development, and through the REST API v1.

With the API, you create a request by sending the PDF and a JSON object. The client_reference field makes creation idempotent; each signer has a reference, a name, an email, an order and, optionally, a language (fr, en or ar) that sets both their signing page and their emails. The optional email object applies your brand to invitations and reminders: sender_name, message and logo_url.

REQUEST_JSON='{
  "client_reference": "hr-contract-2026-0042",
  "signers": [
    {
      "reference": "employee",
      "name": "سارة العتيبي",
      "email": "sara@example.com",
      "order": 1,
      "locale": "ar"
    }
  ],
  "email": {
    "sender_name": "Acme HR",
    "message": "يرجى توقيع عقد العمل قبل يوم الخميس.",
    "logo_url": "https://example.com/logo.png"
  }
}'

curl --fail-with-body -sS \
  -H "Authorization: Bearer $KHATM_API_KEY" \
  -F "document=@contrat-ar.pdf;type=application/pdf" \
  -F "request=$REQUEST_JSON" \
  "$KHATM_BASE_URL/v1/signature-requests"

1. Place fields in the request, from a template, or ask for suggestions with detect-fields and confirm them.
2. Activate the request. With send_emails, Khatm sends each signer an invitation in their language, under your brand; link_expiry_days sets how long the link stays valid (1 to 30 days, 7 by default). You can also take the signing link and send it in your own emails.
3. Receive webhooks signed with HMAC-SHA256: signature_request.completed, signature_request.declined or signature_request.cancelled.
4. Download the signed PDF, the PDF evidence report and the JSON evidence.

A request accepts up to 10 signers and 100 fields, for a PDF of up to 8 MiB. PDFs are encrypted at rest and each document is identified by a SHA-256 digest. API documentation Developers page

From the sandbox to production

The sandbox is self-serve: create an account, generate a khatm_test_… key and a whsec_… webhook secret, then send your real Arabic templates to test signers. PDFs are signed with a self-signed test certificate, and content is deleted 10 days after the PDF upload.

Production is prepared with Khatm: adapting the flow and your brand, integration with your developers, connecting signer identity through your identity provider, the certificate from your PKI, HSM or trust service provider, and RFC 3161 timestamps when that provider supplies them. Khatm does not issue certificates and is not a qualified trust service provider. National identity services such as Nafath or UAE Pass are not included by default. Plan your implementation

To get started, try the demo without an account, then get a sandbox key and read the docs. Once the Arabic journey works for you, we guide you all the way to production. Try the demo Get a sandbox key

General information, not legal advice. Confirm the requirements for your transaction with the appropriate adviser or receiving authority.