API reference

All operations are functions on the atick module. Load it with CommonJS:

const atick = require("atick");

Every function takes raw Node Buffer values for PDFs and certificates, and an options JSON string where applicable. On any failure a function throws a normal Error; the message is available from err.message. Full TypeScript types ship inindex.d.ts.

import * as atick from "atick";

interface Prepared {
  prepared: Buffer;
  bytesToSign: Buffer;
}

ATick runs server-side only. There is no browser build and no command-line interface.

Signing

atick.signPfx(pdf, pfx, optionsJson) // -> Buffer

Sign pdf with a .pfx/.p12/.pem credential (the format is auto-detected). For a PEM file pass the password as the empty string"" inside the options. Returns the signed PDF bytes.

• pdf — the PDF to sign (Buffer).
• pfx — the credential bytes (.pfx, .p12, or .pem) as a Buffer.
• optionsJson — the options JSON string (see the Options table). Pass the credential password as the password key; use "" for PEM.
• returns — the signed PDF as a Buffer.

const fs = require("fs");
const atick = require("atick");

const pdf = fs.readFileSync("in.pdf");
const pfx = fs.readFileSync("signer.pfx");

const options = JSON.stringify({
  password: "secret",
  cn: "Axonate Tech",
  reason: "Approval",
  page: 1,
  rect: [40, 40, 240, 140],
  pades: true,
  timestamp: true,
  tsa_url: "http://timestamp.example/tsa",
});

try {
  const signed = atick.signPfx(pdf, pfx, options);
  fs.writeFileSync("signed.pdf", signed);
} catch (err) {
  console.error("signing failed: " + err.message);
}

atick.signField(pdf, pfx, optionsJson) // -> Buffer

Sign an existing empty signature field. Use the field_name option to select the field. Returns the signed PDF bytes.

• pdf — a PDF containing an empty signature field (see prepareFields).
• pfx — the credential bytes (Buffer).
• optionsJson — must include field_name; same credential and signing keys as signPfx.
• returns — the signed PDF as a Buffer.

Deferred / remote-key signing

These three functions cover the deferred (eSign / HSM / remote-key) flow: prepare the PDF, sign the returned bytes elsewhere, then embed the resulting CMS.

atick.prepare(pdf, optionsJson) // -> { prepared: Buffer, bytesToSign: Buffer }

Step 1 of deferred signing. Adds an empty signature field, the appearance, and the signature container, then returns the exact bytes that must be signed. Returns an object with twoBuffer properties:

• prepared — the prepared PDF (Buffer).
• bytesToSign — the bytes to sign (Buffer); hash and sign these with the remote key.
• pdf — the PDF to prepare (Buffer).
• optionsJson — appearance and signing options (see the Options table).
• returns — { prepared, bytesToSign } (the Prepared interface in TypeScript).

atick.cmsPfx(data, pfx, optionsJson) // -> Buffer

Produce a detached PKCS#7 / CMS signature over data using a PFX. Useful for producing the CMS that embed expects when the signing credential is a local PFX.

• data — the bytes to sign (typically bytesToSign from prepare) as a Buffer.
• pfx — the credential bytes (Buffer).
• optionsJson — password, hash_algo, pades, timestamp, tsa_url, tsa_auth, ltv, revocation.
• returns — the detached CMS as a Buffer.

Set revocation: true to embed RevocationInfoArchival (the signer's CRL and OCSP responses) inside the CMS, so the signature carries its own revocation proof. Pair it withaddDocTimestamp afterwards to add the DSS for the timestamp chain (PAdES-B-LTA).

const cms = atick.cmsPfx(bytesToSign, pfx, JSON.stringify({
  password: "secret",
  pades: true,
  revocation: true,   // embed RevocationInfoArchival in the CMS
}));
const signed = atick.embed(prepared, cms);

// add the DSS for the timestamp chain
const lta = atick.addDocTimestamp(signed, JSON.stringify({ tsa_url: "http://timestamp.example/tsa" }));

atick.embed(prepared, cms) // -> Buffer

Embed a detached CMS / PKCS#7 into a prepared PDF. Returns the signed PDF bytes.

• prepared — the prepared PDF (prepared from prepare) as a Buffer.
• cms — the detached CMS (from cmsPfx, an eSign reply, or an HSM) as a Buffer.
• returns — the signed PDF as a Buffer.

const { prepared, bytesToSign } = atick.prepare(pdf, options);

const cms = atick.cmsPfx(bytesToSign, pfx, JSON.stringify({ password: "secret" }));
const signed = atick.embed(prepared, cms);

Field templates

atick.prepareFields(pdf, optionsJson) // -> Buffer

Create an empty signature field as a template: the appearance is drawn, but the signature is left empty so it can be signed later with signField. Returns the PDF bytes.

• pdf — the PDF to add the field to (Buffer).
• optionsJson — appearance options plus field_name, page, rect / placements.
• returns — the PDF with an empty field as a Buffer.

Long-term validation & timestamps

atick.addDocTimestamp(pdf, optionsJson) // -> Buffer

Add an archive DocTimeStamp (and the DSS validation material) to an already-signed PDF, producing a PAdES-B-LTA document. Returns the timestamped PDF bytes.

• pdf — an already-signed PDF (Buffer).
• optionsJson — tsa_url, tsa_auth, ltv, contents_size.
• returns — the timestamped PDF as a Buffer.

Documents & utilities

atick.setMetadata(pdf, optionsJson) // -> Buffer

Set the document information (/Info) metadata on a PDF. Returns the updated PDF bytes.

• pdf — the PDF to update (Buffer).
• optionsJson — title, author, subject, keywords, application, created, modified (see the Metadata options table).
• returns — the updated PDF as a Buffer.

atick.decrypt(pdf, password) // -> Buffer

Decrypt a password-protected PDF. Returns the plaintext PDF bytes.

• pdf — the encrypted PDF (Buffer).
• password — the open (user) password as a string.
• returns — the decrypted PDF as a Buffer.

atick.setFastSigning(on) // -> void

Enable or disable the in-memory revocation cache (used to speed up repeated CRL/OCSP lookups). Passing false disables it.

• on — true to enable the cache, false to disable it (boolean).

atick.version() // -> string

Return the engine version string.

• returns — the version as a string.

console.log("ATick " + atick.version());

Options JSON

The optionsJson argument is a JSON object string, built withJSON.stringify({ ... }). All keys are optional unless a function note says otherwise. Keys are grouped below by purpose.

Identity & appearance text

Verified mark

Layout & styling

Placement

Cryptography & PAdES

Certification & locking

Verification

The four verify* flags and trusted_roots run beforeany output is produced; a failed check refuses to sign and throws an Error.

const out = atick.signPfx(pdf, pfx, JSON.stringify({
  password: "secret",
  verify: true,            // umbrella: not expired + CRL + OCSP
  verify_expiry: true,     // or enable the individual checks
  verify_crl: true,
  verify_ocsp: true,
  trusted_roots: ["<root SHA-1>", "<another root SHA-1>"],
}));

Document security

Metadata options

These keys apply to setMetadata.

Errors

Every atick function throws a normal Error on failure — bad password, malformed PDF, network error, invalid options, and so on. The error text is available fromerr.message.

try {
  const signed = atick.signPfx(pdf, pfx, options);
} catch (err) {
  console.error("ATick error: " + err.message);
}