# BoldSign vs Documenso (slim)

> BoldSign scores 70.3 (BB) to Documenso's 59.8 (C) for e-signatures. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/boldsign-vs-documenso.md (~4,150 tokens) · this version ~2,330 tokens · JSON https://www.anchorterminal.com/compare/boldsign-vs-documenso.json · canonical https://www.anchorterminal.com/compare/boldsign-vs-documenso
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

BoldSign scores 70.3 (BB) on agent readiness against Documenso's 59.8 (C), and leads in 4 of 7 scored categories. Documenso leads on maintenance & community. Both do e-signatures.

- BoldSign: BB 70.3, rank #190 of 1349 · https://www.anchorterminal.com/tools/boldsign.min.md
- Documenso: C 59.8, rank #605 of 1349 · https://www.anchorterminal.com/tools/documenso.min.md
- BoldSign, good for A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server. Ahead on Schema & documentation, 85 against 79; Security & auth, 63 against 52; Payments & pricing, 40 against 30. Also Agent-ready, a grade of BB or better; No incidents deducted, where Documenso loses 8 points for them.
- Documenso, good for Teams that want an e-signature API they can also self-host, with templates, embedded signing and an audit log by API. Ahead on Maintenance & community, 93 against 78. Also Open source.

| Category | BoldSign | Documenso |
| --- | --- | --- |
| Reliability (16%) | 84 | 85 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 79 |
| Agent ergonomics (13%) | 62 | 64 |
| Security & auth (14%) | 63 | 52 |
| Payments & pricing (10%) | 40 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 78 | 93 |
| Transparency & trust (7%) | 77 | 75 |

| Fact (where they differ) | BoldSign | Documenso |
| --- | --- | --- |
| Vendor | Syncfusion, Inc. | Documenso, Inc. |
| Hosted endpoint | `https://api.boldsign.com/v1` | `https://app.documenso.com/api/v2` |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | OAuth or key | API key |
| Price for e-signatures | $0.25 per transaction | not published |
| Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | AGPL-3.0 for the Community Edition, with a commercial Enterprise Edition licence. The TypeScript, Python and Go SDKs are MIT. The hosted cloud runs under Documenso's terms of service |
| Tools exposed | 14 | none |
| Last release | 2026-10-16 | 2026-10-22 |
| Terms last updated | 2025-02-01 | no date given |
| Privacy policy last updated | 2026-07-01 | no date given |
| Terms or service can change without notice | not found in the text | yes |
| Popularity | 1 stars | 15k stars, 48k npm/wk, 3.6k PyPI/wk |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Maintenance & community, Documenso +15: BoldSign 78 (Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.); Documenso 93 (v2.21.1 was released on 22 October 2026 (30). Six releases in the 90 days to 2 November, v2.17.0 (19 August), v2.18.0 (9 September), v2.19.0 (29 September), v2.20.0 (8 October), v2.21.0 (19 October) and v2.21.1 (22 October), read from the repository's tags (20). 123 open issues on GitHub on 7 October, with the newest eight all answered by at least one comment, per the 7 October check (github.com pages weren't readable on 2 November); 115 commits to the main branch since 4 August, the latest on 29 October (20 of 25). Official SDKs for TypeScript (0.9.1, 1 September 2026), Python (0.6.0, 7 February 2026) and Go, per the 7 October check (15). CI, end-to-end test and CodeQL workflows in the repository, and libpdf and critical dependencies upgraded in v2.20.0. We couldn't read the current CI result (8 of 10). 30 + 20 + 20 + 15 + 8 = 93.)
- Security & auth, BoldSign +11: BoldSign 63 (OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.); Documenso 52 (Revocable API tokens with optional expiry, limited to one team but with full access inside it and no scopes (20 of 30). No read-only token and no confirmation step before distribute, cancel or delete (4 of 20). Signer names and field values come back through the API with no guidance on treating them as untrusted (3 of 15). Each envelope has an audit log with timestamps and IP addresses, readable by API and as a PDF. No log of API token use was found (10 of 15). security.txt without an Expires field, a disclosure policy with a 48-hour acknowledgement target, advisories published on GitHub, CodeQL in CI and a SOC 2 Type II badge on the trust page. No bug bounty found (15 of 20). Webhook requests carry the shared secret in plain text instead of a payload signature.)
- Payments & pricing, BoldSign +10: BoldSign 40 (Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.); Documenso 30 (Scored on the hosted cloud, which is the graded surface. No x402, MPP or L402 (0). Plan prices are public, $0, $25, $40 and $250 a month, with no per-document or per-call price (10). Free plan with API access and 5 documents a month, and the pricing page mentions no card (20). A person has to sign up and create the token in the web app (0).)
- Schema & documentation, BoldSign +6: BoldSign 85 (A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.); Documenso 79 (Public OpenAPI 3.0.3 spec at app.documenso.com/api/v2/openapi.json with 89 operations (25). llms.txt and llms-full.txt on the docs site (10). Every operation has a summary or description, though few say when not to use a call (12). Typed request bodies with enums throughout and required fields marked (13). The spec has no examples. The guides carry curl and JavaScript examples and a table of error codes with recommended actions, and one guide page shows a Bearer prefix that the authentication page doesn't use (9). A versioning page and GitHub release notes, which are lists of merged pull requests, and the spec's own version stays at 1.0.0 (10).)