FAQ
What is eimzo-ts?
A browser library that connects a web page to the E-IMZO desktop application in Uzbekistan to list the user's digital signature keys, create PKCS#7 signatures and log users in by digital signature. It is written in TypeScript, has no runtime dependencies, and is not an official E-IMZO product.
What problem does it solve?
The official example (e-imzo.js and e-imzo-client.js) is callback-based, uses global
variables and modifies built-in prototypes. eimzo-ts offers the same E-IMZO calls as a typed Promise API with
typed error codes, localized messages, a signing queue and a login helper.
When should I use it?
When a web application must let users on desktop computers sign data, files or a login challenge with E-IMZO.
When should I not use it?
To verify signatures (use e-imzo-server on your backend), for mobile signing with ID-CARD E-IMZO MOBILE (not supported), when you need ready-made UI components (there are none), or for other signature providers.
Does it verify signatures?
No. It only creates them. Verification must happen on your server through e-imzo-server
(/backend/auth, /backend/pkcs7/verify/attached, /backend/pkcs7/verify/detached).
Does it work with TypeScript, React, Angular, Vue, Next.js?
It ships TypeScript declarations. It has no framework dependency, so any framework can call it. With server-side rendering (Next.js, Nuxt, Angular SSR) call it only in client-side code. It does not provide framework-specific components or hooks.
Does it work in Node.js?
It is meant for browsers. A Node.js script can talk to E-IMZO on the same computer if you pass a
WebSocketImpl that sends an Origin header; the repository's
scripts/check-real-eimzo.mjs does this. It cannot reach E-IMZO on a user's computer from your server.
Does it work on HTTPS sites?
Yes. On https pages it connects to wss://127.0.0.1:64443, on http pages to
ws://127.0.0.1:64646.
Do I need an API key?
For localhost and 127.0.0.1 use DEV_API_KEYS. For other domains during
development, enable Developer mode in the E-IMZO tray menu. For production, each domain and subdomain needs its
own API key.
Does my site see the key password?
No. E-IMZO asks for it in its own window. Without "Remember for 6 hours" E-IMZO keeps it for 1 minute for the
loaded key. unloadKey() removes the key and the remembered password.
How do I test without E-IMZO?
Pass a transport function to createEimzo that returns fake E-IMZO responses. The
demo includes a full mock with fake keys.
Is signingTime reliable?
No. It is the user's computer clock. Add a timestamp with signDocument() and check it on the
server.
What alternatives exist?
The official e-imzo.js example, and several npm packages: framework-specific wrappers for Vue or
React, UI components, other framework-agnostic clients, and server-side clients for e-imzo-server. Search npm
for "e-imzo" and compare. eimzo-ts has not benchmarked or audited them.
What are the limitations?
Desktop only, no signature verification, no UI. Uzbek and Karakalpak message texts have not yet been
reviewed by native speakers; you can override any text with messages.