> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/remote-key-storage/signing-with-a-stored-key.md).

# Signing with a Stored Key

## Flow

| #  | Actor            | Step                                                                                                    |
| -- | ---------------- | ------------------------------------------------------------------------------------------------------- |
| 1  | Subscriber → ASP | Logs in to the ASP application (application-level authentication).                                      |
| 2  | ASP → KMS        | Submits a signed `<Esign>` request with up to 10 document hashes, a unique `txn` and optional username. |
| 3  | KMS → ASP        | Acknowledges with `status="2"` (pending).                                                               |
| 4  | ASP → Subscriber | Redirects the subscriber to the KMS authentication page (`txnref`).                                     |
| 5  | Subscriber → KMS | Reviews the documents, enters username and AuthPIN.                                                     |
| 6  | KMS ↔ SAM        | SAM returns a fresh nonce and its public key; KMS encrypts the AuthPIN and forwards it.                 |
| 7  | SAM              | Verifies the AuthPIN inside the HSM, enforces lockout, issues a session token bound to the hashes.      |
| 8  | KMS → SHI → HSM  | Forwards authorised hashes and session token; SAM validates the token; the HSM signs.                   |
| 9  | KMS → ASP        | POSTs the final `EsignResp` (signatures + certificate) to `responseUrl`; redirects the browser.         |
| 10 | ASP              | Verifies the response signature and embeds signatures into the documents.                               |

## Batch signing

Up to **10 documents** can be signed with a single AuthPIN entry. The session token covers exactly those hashes; adding or changing a document requires a new authorisation.

## Output formats

Same as eSign v3: `raw`, `PKCS7`, `PKCS7pdf` (chain + revocation + timestamp, for PDF/LTV) and `PKCS7complete`.

## Handling outcomes

| Outcome       | Indicator                                                          |
| ------------- | ------------------------------------------------------------------ |
| All signed    | `status="1"`, each `DocSignature` populated                        |
| Some rejected | `status="1"`, rejected `DocSignature` with error "User Rejected"   |
| Timed out     | `status="0"`, user timeout (`maxWaitPeriod` exceeded)              |
| Locked        | `status="0"`, lockout error — direct the user to reset via eMudhra |