HOWTO · Business Wallet · sign.html

Sign invoices with the Business Wallet — on behalf of the company.

An accounting team with several employees who need to sign on behalf of the same company needs a central corporate wallet identity. The flow is the same direct path as with a personal wallet — except that the signing certificate also carries the company name and every signature is logged in the Business Wallet audit trail.

What you need. A Business Wallet instance on CodeB (your company as its own OIDC tenant), a modern browser, and a European Digital Identity Wallet per employee (or corporate SSO chained to an EU Wallet).

1 Personal vs. Business wallet identity

Property	Personal EU Wallet	Business Wallet
Who signs	Natural person	Natural person on behalf of the legal entity
Certificate Subject DN	`CN=Given Family`, SAN e-mail	`CN=Given Family`, `O=Company Ltd`, SAN e-mail
Audit log	Wallet-local	Central: which employee signed which hash when
Multiple signers	Wallet holder only	All employees enrolled in the admin panel
Bulk signing	One at a time via sign.html	One at a time via sign.html, or scripted via the CSC v2 API

2 Enrol authorised employees (one-off)

In the admin panel of your Business Wallet instance, define for each employee allowed to sign on behalf of the company:

The employee's OIDC identity (e.g. their European Digital Identity Wallet or a corporate SSO account bound to it)
Role (authorised signer, approval-only, etc.)
Optional limits (max invoice amount, max signatures/day)

Changes to the enrolment list are recorded in the Business Wallet log and can be produced during audits.

3 Employee signs in with their EU Wallet

The employee opens logineu.html and signs in with their personal European Digital Identity Wallet. Our OIDC backend uses the wallet identity to look up their role in the company tenant — the personal PID identity is thereby linked to the company role.

4 Sign the invoice by drag-and-drop

The employee opens sign.html. The server mints (if not already present) a signing certificate carrying both the company name and the employee name:

CN: employee's given and family name
O: company name (legal entity)
SAN rfc822Name: employee's e-mail

The PDF is loaded by drag-and-drop, the PAdES level (B-T / B-LT / B-LTA) chosen, and signed. Flow and technical details are identical to the personal wallet — see the personal wallet HOWTO for step-by-step. The only difference is the additional company information in the certificate.

5 Audit log

For every signature the following is recorded centrally:

Time (UTC)
Signing employee (OIDC sub)
Company certificate used (serial number)
SHA-256 hash of the signed PDF
URL of the QTSP that issued the timestamp

The log is exportable from the admin panel (CSV, JSON) and forms part of your GoBD procedural documentation. It is itself signed.

6 Higher volume? Reach for the API

If your accounting team signs several hundred invoices per month, PDF-by-PDF drag-and-drop is not practical. The CSC v2 API uses exactly the same company certificates and exactly the same signing module, but can be called from your accounting software, ERP or a batch script. Full walkthrough: HOWTO: Sign invoices via CSC v2 API.

Back to overview HOWTO: API HOWTO: personal wallet Deutsch