> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/onboarding-as-an-asp.md).

# Onboarding as an ASP

Any organisation that wants to request eSign signatures directly must be onboarded with eMudhra as an **Application Service Provider (ASP)**, as required by the CCA *On-boarding Guidelines for ASPs*.

## Eligibility

ASPs must be legal entities, for example:

* Central / State Government ministries, departments and their undertakings
* Banks, financial institutions, NBFCs and insurance companies
* Companies registered under the Companies Act and LLPs
* Other entities permitted under the CCA guidelines

Organisations that do not wish to register can use eSign through **emSigner**, which acts as the integrating application.

## Onboarding steps

| Step | Activity                                                                                     | Output                             |
| ---- | -------------------------------------------------------------------------------------------- | ---------------------------------- |
| 1    | Submit the ASP application with entity KYC documents and use-case description                | Application reference              |
| 2    | Execute the **ASP–ESP agreement** (based on the CCA sample agreement)                        | Signed agreement                   |
| 3    | Procure an **organisational DSC / ASP signing certificate** for signing request XML          | Certificate mapped to your `aspId` |
| 4    | Receive **UAT credentials** — `aspId`, endpoint URLs, test eKYC identities                   | UAT access                         |
| 5    | Integrate using the API specification or eMudhra SDK/integration kit                         | Working integration                |
| 6    | Complete **UAT sign-off** — functional test cases, error handling, audit trail               | Test report                        |
| 7    | Complete **security and compliance review** (consent screens, data handling, key protection) | Go-live approval                   |
| 8    | Receive **production credentials** and IP allow-listing                                      | Live                               |

## ASP obligations

* Generate the document hash on the ASP side and send **only the hash**.
* Display the document to the signer and obtain **explicit consent** before calling eSign (`sc="Y"`).
* Sign every request XML with the registered ASP certificate and **protect that private key** (HSM or secure keystore recommended).
* Use a unique `txn` per transaction and keep server time synchronised (requests outside ±30 minutes are rejected).
* Verify the ESP signature on every response before using it.
* Store `txn`, `resCode`, timestamps and the signed document for audit.
* Do not store Aadhaar numbers, biometrics or OTPs. The ASP never receives eKYC data from eSign.

## Commercial model

eSign is offered on an API subscription / transaction model. Contact your eMudhra account manager for pricing by product and volume.