ATick for Python

Standalone PDF digital-signature library for Python — PAdES / CMS signing with zero external dependencies.

Also available in other languages — the same ATick engine, the same API, native to each ecosystem:

ATick signs PDFs the way Adobe Acrobat and the EU DSS do — PAdES baseline signatures with timestamps and long-term validation — but everything ships inside the one package, so there are no dependencies to install at all. pip install atick and you are done. There's a Python API and a full command-line tool.

import atick

signed = atick.sign_pfx(
    open("doc.pdf", "rb").read(),
    pfx=open("my.pfx", "rb").read(), password="••••",
    style=atick.Style(cn="Aniket Chaturvedi", reason="Approved"),
    placements=[(1, (300, 55, 575, 175))],
    pades=True, timestamp=True, ltv=True,     # PAdES-B-LT
)
open("signed.pdf", "wb").write(signed)

ATick draws a verified-signature appearance with a green tick. When the certificate is valid and trusted, Adobe Reader / Acrobat shows “Signed and all signatures are valid.”

Adobe colours that same mark by the signature's real status — you don't draw these, Adobe does:

Valid & trusted green tick

Validity unknown yellow “?”

Not verified “?” not validated

Invalid red cross

The green tick appears only when the signature is valid and the certificate chains to a root Adobe trusts.

pip install atick

No other packages are required. (Windows-store signing is Windows-only; everything else is cross-platform.)

atick.sign_pfx(pdf, pfx=…, password=…, style=…, placements=…)              # .pfx / .p12 / .pem (auto-detected)
atick.sign_pkcs11(pdf, dll=…, pin=…, serial=…, style=…, placements=…)      # USB token / smart-card / HSM
atick.sign_winstore(pdf, style=…, placements=…, thumbprint=None)           # Windows store (certificate picker)

A PEM file (unencrypted PKCS#8/PKCS#1 key + one or more CERTIFICATE blocks) works in the same sign_pfx call — pass its bytes as pfx= (and password=""); the format is auto-detected.

All three accept the same options: pades=, hash_algo=, timestamp=, tsa_url=, tsa_auth=, ltv=, lta=, certify=, lock_fields=, verify=, trusted_roots=, plus (on sign_pfx) open_password=, encrypt_password=, owner_password=.

The little icon in the appearance — what Adobe shows for the signature's validity:

atick.Style(cn="…", green_tick=True)     # the "?" mark — Adobe paints it GREEN for a valid+trusted cert, RED if invalid
atick.Style(cn="…", always_check=True)   # our green-tick graphic as the base — Adobe still reds it if the signature is bad
atick.Style(cn="…", green_tick=False)    # no mark at all — a plain, basic signature

Colour the mark with any Python colour: mark_color="#E53935", "blue", (255, 140, 0) — or a gradient mark_gradient=["red", "orange", "yellow"]. The mark is always centred in the appearance.

atick.Style(cn="Aniket Chaturvedi", image="cn")                       # CN as text on the LEFT (Adobe-style)
atick.Style(cn="Aniket Chaturvedi", dn="CN=Aniket, O=Personal, C=IN") # DN under the "Signed by:" line
atick.Style(body="*APPROVED*\nReviewed by: *Aniket*\nLegally *binding*.")  # ONLY this text; \n = line, *x* = bold
atick.Style(cn="…", image="logo.png")                                 # your own logo (default = ATick logo)
atick.Style(cn="…", image=False)                                      # no logo

Long names wrap onto more lines instead of shrinking the font, so the appearance never overflows.

ON by default. With LTV on, the first signature fetches the certificate's CRL/OCSP; ATick caches it in-memory, so every later signature with the same certificate reuses it instead of re-fetching — a big speed-up for batch / multi-signature runs (≈ 6× in practice). Timestamps are never cached (each must be unique).

atick.set_fast_signing(False)      # always fetch fresh (also clears the cache)
atick.clear_revocation_cache()     # forget cached revocation (e.g. after changing certificate)

signed = atick.sign_pfx(already_signed_pdf, pfx=…, password=…, style=…, placements=…)

ATick signs as an incremental update, so existing signatures keep their byte ranges and stay valid. The field name is auto-uniquified (Atick_1, Atick_2, …), so re-signing never collides; pass field_name="…" for a specific name.

eSign needs one extra package. Signing the eSign request XML requires the separate managex-xml-sdk package — pip install managex-xml-sdk. It is only needed for eSign; every other ATick feature works with no extra installs.

A two-step flow — sign the eSign request XML with managex-xml-sdk, then embed the ESP's reply with ATick:

prepared, ctx = atick.prepare_deferred_multi(pdf, style, placements, sub_filter="adbe.pkcs7.detached")
input_hash_hex = bytes(ctx["digest"]).hex()        # the InputHash for the eSign request XML
# ... build the <Esign …> request, sign it with managex-xml-sdk, POST to the ESP, read EsignResp ...
signed = atick.embed(prepared, doc_signature_cms)  # pkcs7 / pkcs7Pdf / pkcs7complete
# rawrsa: atick.embed_rawrsa(prepared, raw_sig, user_cert)

pkcs7Pdf / pkcs7complete responses already carry the chain + revocation + timestamp, so the embedded signature is LTV-complete. See examples/esign/.

atick.sign_pfx(pdf, pfx=…, password=…, style=…, placements=…, pades=True)             # B-B
atick.sign_pfx(pdf, …, pades=True, timestamp=True)                                    # B-T
atick.sign_pfx(pdf, …, pades=True, timestamp=True, ltv=True)                          # B-LT
atick.sign_pfx(pdf, …, pades=True, timestamp=True, lta=True)                          # B-LTA

B-LT/B-LTA embed the complete validation material (chain + CRL + OCSP + VRI + /Extensions /ESIC) so Adobe Acrobat shows “PAdES Signature Level: B-LT” in the advanced signature properties.

Every feature is available from the terminal too:

atick sign in.pdf out.pdf --pfx my.pfx --password ••• \
      --cn "Aniket Chaturvedi" --reason Approved \
      --timestamp --ltv --always-check --cn-left --dn "CN=Aniket, O=Personal, C=IN" \
      --page 1 --rect 300,55,575,175

atick sign in.pdf out.pdf --pfx my.pfx --password ••• --body "*APPROVED*\nby *Aniket*"  # custom text only
atick sign-token    in.pdf out.pdf --dll lib.dll --pin ••• --serial HEX --ltv
atick sign-winstore in.pdf out.pdf            # opens the Windows certificate picker
atick list-token    --dll lib.dll --pin •••
atick esign-prepare in.pdf prepared.pdf --certify form-annots   # eSign step 1 (prints the InputHash)
atick esign-embed   prepared.pdf response.xml out.pdf           # eSign step 2 (embeds the ESP reply)
atick metadata      in.pdf out.pdf --title "Agreement" --author "Aniket"
atick decrypt       in.pdf out.pdf --password •••
atick version

Run atick <command> -h for the complete option list (or python -m atick …). Every failure is a clean Python atick.AtickError (or a TypeError for a wrong argument) that you can catch.

Self-contained, runnable scripts live in examples/ (each writes to examples/signed/):

01_sign_pfx · 02_pades_levels · 03_appearance · 04_certify_and_lock · 05_multi_placement · 06_token_pkcs11 · 07_windows_store · 08_deferred_esign · 09_verify_certificate · 10_encrypted · 11_mark_color · 12_metadata · 13_hash_algorithms · 14_field_api · 16_invisible · 17_multi_revision (rev1 → rev2 → rev3) · 18_date_and_pem (date formats + PEM signing) · always_green_tick · green_tick · without_green_tick · make_container · sign_already_signed · document_timestamp · fast_signing · esign/ (eSign 2-step: esign_prepare + esign_embed).

Every example uses only ATick (the esign/ flow also uses your managex-xml-sdk to sign the request XML). Run any with python examples/<name>.py.

Full documentation lives in docs/ (Sphinx + Markdown) — installation, signing, PAdES, appearance, certification, eSign, the CLI and the complete API reference. Build it with pip install -r docs/requirements.txt && sphinx-build -b html docs docs/_build. Publishing the package and hosting the docs (Read the Docs, GitHub Pages, …) is covered in PUBLISHING.md.

Everything raises atick.AtickError (a normal Python exception) you can catch:

try:
    atick.sign_pfx(pdf, pfx=…, password="wrong", style=…, placements=…)
except atick.AtickError as e:
    print("signing failed:", e)

ATick is dual-licensed — free for personal & open use, paid if you sell:

• Free under GNU AGPL-3.0 — personal projects, learning, internal use, and open-source projects (released publicly under AGPL-3.0).
• Commercial license (paid) — if you build a product with ATick and sell it, or use it in a closed-source / commercial product, you must buy a commercial license first. Contact aniketc.pro@gmail.com for a quote.

See LICENSING.md for details. © 2026 Aniket Chaturvedi.