Blog ·

How Class 3 DSC USB token signing works

Learn how Class 3 DSC USB tokens sign PDFs with PKCS#11, why the private key never leaves the token, and how IG E-Sign connects your API to a Windows agent.

Why Class 3 DSC still matters in India

Indian businesses, CA firms, and ERP teams often need signatures backed by a Class 3 Digital Signature Certificate on a USB token. The private key stays on the hardware device, which is a common requirement for tax invoices, statutory filings, and internal controls.

Cloud-only click-to-sign tools are useful for multi-party agreements, but they do not replace token-based DSC workflows where the certificate must remain under the signer’s physical control.

The IG E-Sign USB signing flow

IG E-Sign splits the work between your server and a Windows desktop agent on the PC where the USB token is plugged in.

  • Your server creates a signing job with the PDF and target device ID.
  • The Windows agent fetches the prepared job and prompts for the token PIN.
  • Signing happens locally via PKCS#11 — the private key never leaves the token.
  • Your server polls job status and downloads the signed PDF when complete.

What you need to get started

Pair the IG E-Sign Agent from your dashboard, keep it running in the system tray, and call the USB signing API from your backend. Browser apps on ERP pages should only talk to the local agent for the PIN step — never embed API keys in frontend code.