Three lines. Every PDF you ship carries the seal.

import Deepstamp from "deepstamp";

const ds = new Deepstamp(process.env.DS_KEY);

app.get("/invoice/:id", async (req, res) => {
  const pdf = await buildInvoice(req.params.id);
  const sealed = await ds.seal(pdf, {
    ref: req.params.id,
    issuer: "acme-billing",
  });
  res.setHeader("Content-Type", "application/pdf");
  res.send(sealed);
});