> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Code signing

> Sign software artifacts with managed code-signing certificates, central approval, and a full audit trail.

Code Signing is where teams digitally sign software, such as JARs, container images, Windows installers, Android APKs, Linux packages, and scripts. Teams sign through any tool that supports PKCS#11, with Windows `signtool`, or with the [Sign API](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/sign.md), and Infisical records every signing operation in an audit trail.

> [card] [Signers](https://infisical.com/docs/documentation/platform/pki/code-signing/signers)
>
> Create signing identities and choose who can sign with each one.

> [card] [Approvals](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals.md)
>
> Require approval before someone can sign, with limits on how many signatures and for how long.

> [card] [Signing tools](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/jarsigner.md)
>
> Sign with jarsigner, apksigner, osslsigncode, cosign, OpenSSL, or GPG.

> [card] [PKCS#11 module](https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module.md)
>
> Connect standard signing tools to your signers.

> [card] [Windows KSP](https://infisical.com/docs/documentation/platform/pki/code-signing/windows-ksp.md)
>
> Sign Windows executables, DLLs, and MSIs with signtool.

Each **Signer** represents a single signing identity, like `mobile-app-prod`, `firmware-release`, or `ci-staging-builds`. Product Admins create Signers, attach a code-signing certificate, and assign team members. Teams then operate independently within their assigned Signers.

## What's in a signer?

> [card] Certificate
>
> The X.509 code-signing certificate the Signer uses, backed by an internal or external CA.

> [card] Members
>
> Team members with Administrator, Operator, or Auditor roles on this Signer.

> [card] Approval policy
>
> Optional review workflow before signatures are produced.

> [card] Activity
>
> Audit trail of every successful, failed, and denied signing operation.

## How a signing operation flows

```mermaid theme={"dark"}
sequenceDiagram
    participant Tool as Signing tool<br/>(jarsigner / cosign / ...)
    participant PKCS as PKCS#11 Module
    participant Infisical as Infisical
    participant CA as Certificate Authority

    Note over Infisical,CA: Once, when the Signer is created
    Infisical->>CA: Request code-signing cert
    CA-->>Infisical: Certificate

    Note over Tool,Infisical: Per signing operation
    Tool->>PKCS: Sign artifact
    PKCS->>Infisical: POST /signers/{id}/sign
    Infisical->>Infisical: Check access
    Infisical->>Infisical: Sign
    Infisical-->>PKCS: Signature
    PKCS-->>Tool: Signature attached to artifact
```

1. A Product Admin creates a [Signer](https://infisical.com/docs/documentation/platform/pki/code-signing/signers) and picks the CA that issues its certificate.
2. The Admin adds [members](https://infisical.com/docs/documentation/platform/pki/code-signing/signers#signer-roles) (users, machine identities, or groups) and picks a role for each.
3. Optionally, the Admin attaches an [approval policy](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals.md) so signing requires sign-off.
4. Operators sign through the [PKCS#11 module](https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module.md), the [Windows KSP](https://infisical.com/docs/documentation/platform/pki/code-signing/windows-ksp.md) (`signtool`), or the [Sign API](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/sign.md). Infisical produces the signature and records an audit entry on the Signer.

## Signer roles

Members are assigned to Signers with one of three roles:

| Role | Capabilities |
| - | - |
| **Administrator** | Full control: edit settings, manage members, edit the approval policy, pre-approve signing, sign, export the certificate. |
| **Operator** | Sign artifacts and submit signing requests. Can't change settings or members. |
| **Auditor** | Read-only: view members, activity, and the audit log. Can't sign. |

## FAQ

> [accordion] How is this different from handing out a .pfx or .p12 file?
>
> When you distribute a key file, anyone with a copy can sign anything for the lifetime of the certificate, and you can't take that copy back. With a Signer, you can disable signing, revoke active access, or remove a member at any time, and that change takes effect immediately.

> [accordion] Do I have to require approval for every signature?
>
> No. A Signer can have no approval policy, in which case any member with sign rights can sign immediately and you still get a full audit trail. Approvals are optional and most useful for production releases or compliance-sensitive workloads.

## What's next?

> [card] [Create a Signer](https://infisical.com/docs/documentation/platform/pki/code-signing/signers#create-a-signer)
>
> The 4-step wizard.

> [card] [Add an approval policy](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals.md#configure-the-approval-policy)
>
> Require sign-off and cap per-approval limits.

> [card] [Install the PKCS#11 module](https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module.md#installation)
>
> Hook up your signing tools.

> [card] [Sign your first JAR](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/jarsigner.md)
>
> End-to-end walkthrough.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.