Any Indian product that needs a legally binding signature — a loan agreement, a rental contract, an insurance proposal, an employment offer — eventually faces the same choice between two mechanisms, both recognised under the IT Act's Second Schedule, that behave completely differently in a user journey. Getting the choice right is largely about who is signing and how often.
Aadhaar eSign was brought into Schedule 2 by Gazette Notification GSR 61(E) dated 27 January 2015. It works in two steps: an on-the-fly Aadhaar eKYC authentication, usually by OTP but also available by biometric or iris, followed by affixture, where an Electronic Signature Certificate is generated and applied to the document. The signer needs only a valid Aadhaar and a phone or email linked to it. It works on any device, anywhere, and completes in under a minute.
A Digital Signature Certificate is the older mechanism and is bound to a physical USB token. It uses the same cryptographic elements, but possession of the hardware is mandatory, which means it works on a laptop or desktop and nowhere else. Procurement takes weeks through a multi-step process, and the token costs upward of a thousand rupees a year to hold. For an individual signing one agreement, that is an absurd amount of friction; for a company officer who signs statutory filings every week, it is entirely reasonable.
That contrast is the whole decision. If your signers are consumers or small business owners signing occasionally, Aadhaar eSign is the only realistic option — a flow that requires the user to buy a USB token first will lose almost everyone. If your signers are company officers, chartered accountants or anyone already filing with government portals, they very likely hold a DSC already, and supporting it means meeting them where they are rather than asking them to authenticate a different way.
For engineering, the practical work is not the cryptography — you will integrate through an eSign service provider rather than implement it — but the surrounding state machine. A signature request has a lifecycle: created, sent, viewed, authenticated, signed, or expired and abandoned. Users drop out mid-flow and return later. Multi-party documents need each party's status tracked separately. And the signed artefact, with its certificate and audit trail, is the thing you must be able to produce years later if the agreement is disputed, so where and how you store it matters more than how you generated it.
Two cautions. Not every document can be executed electronically in India — certain instruments are excluded and require a wet signature, so check the specific document type with a lawyer rather than assuming the mechanism covers everything. And Aadhaar eSign involves an eKYC authentication, which means it carries the same data minimisation discipline as any Aadhaar interaction: store the signed document and the evidence of signing, not the identity payload that produced it.
