# FactuGES Document Signing Service

## Authentication

`POST /documents/sign` requires a technical credential configured in
`SERVICE_API_KEY` and sent as `Authorization: Bearer <SERVICE_API_KEY>`.
`GET /health` and `GET /version` remain public. Set `PDF_MAX_SIZE_BYTES` to
limit in-memory PDF uploads (default: 10 MiB).

The multipart fields `certificate_secret_name`,
`certificate_password_secret_name`, and `company_slug` remain required for
backwards compatibility. Certificate selection continues to use
`CERT_SECRET_NAME` and `CERT_PASSWORD_SECRET_NAME`.

Any Infisical credentials that were previously committed must be revoked or
rotated in Infisical outside this repository.