EGKits ETA Signing Agent
On-premises ETA e-signature companion
Securely connect EGKits E-Invoices with local USB security tokens (Egypt Trust / SafeNet) for ETA CAdES-BES signing when the SaaS backend cannot access the token.
At a glance
Publisher: IDSYSEG / EGKits
Windows 10 / Windows 11
MSI
.NET runtime included (self-contained win-x86)
What this tool does
Securely connect EGKits E-Invoices with local USB security tokens (Egypt Trust / SafeNet) for ETA CAdES-BES signing when the SaaS backend cannot access the token.
Compatibility
.NET runtime included (self-contained win-x86)
Key features
Polls EGKits for invoices awaiting signature and completes ETA submission
Local loopback signer bridge for client-side signature mode
Client workstation (tray) and server (Windows service) install modes
PKCS#11 silent PIN login to avoid repeated token dialogs
Multi-tenant signing farm with one agent instance per tenant token
Daily rolling logs under ProgramData
System requirements
Windows machine with the USB tax token plugged in and vendor middleware installed
Signing certificate visible in certmgr (Personal store)
EGKits service account with Sign Invoices permission (no MFA)
Network access to the EGKits API base URL
Installation
Before you install
Install the token middleware so the certificate appears in Personal Certificates.
Create or confirm a dedicated EGKits service account with Sign Invoices permission.
Decide client (workstation tray) vs server (Windows service) deployment.
Install
Download the official MSI from this page.
Client: msiexec /i EGKitsEtaSigningAgent.msi
Server: msiexec /i EGKitsEtaSigningAgent.msi INSTALLMODE=server
After install
Edit appsettings.json under Program Files (x86)\EGKits\EtaSigningAgent as administrator.
Set BackendBaseUrl, Tenant, credentials, certificate thumbprint, and optional TokenPin.
Restart the agent (tray) or Windows service after saving settings.
Configuration
Prefer Agent:CertificateThumbprint to select the token certificate.
For ePass2003-style tokens, set Agent:TokenPin and optional Pkcs11ModulePath.
Client-side signing: keep LocalBridgeEnabled true; farm hosts should disable the bridge.
Troubleshooting
Check %ProgramData%\EGKits\EtaSigningAgent\logs\agent-YYYYMMDD.log for startup and signing errors.
If the PIN dialog still appears, verify PKCS#11 module path (32-bit DLL for the x86 agent).
Confirm the web app SigningAgentDownloadUrl / ETA configuration points at this official MSI.