---
title: "Certificate requirements - Signature sessions"
description: "How to restrict the certificates users can choose in a Rest PKI Core signature session with certificate requirements, such as a crypto device."
canonical: "https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/certificate-requirements"
locale: "en"
product: "Rest PKI Core"
last_updated: "2026-07-22"
---

# Certificate requirements - Signature sessions

In order to restrict the certificates that the user will be able to choose during a [signature session](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions), specify a list of
**certificate requirements** when creating the session. The user will only be able to select certificates that meet **all** of the specified
requirements.

Each requirement is composed of a **type** and, depending on the type, an **argument**. For instance, let's say you need to restrict users to only
sign documents using certificates whose private key is protected by a cryptographic device, which is what the [CryptoDevice](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/certificate-requirements#crypto-device)
requirement does. This specific requirement does not take an argument, so we only have to specify its type.

On .NET:

```cs
var response = await restPkiService.CreateSignatureSessionAsync(new CreateSignatureSessionRequest() {
	...,
	CertificateRequirements = new List<CertificateRequirement> {
		new CertificateRequirement { Type = CertificateRequirementTypes.CryptoDevice }
	}
});
return Redirect(response.RedirectUrl);
```

Direct API integration:

```plaintext
POST {endpoint}/api/signature-sessions
{
	...,
	"certificateRequirements": [
		{
			"type": "CryptoDevice"
		}
	]
}
```

See the different requirement types available on the next section.

## Supported requirement

The following requirement types are currently available:

* [CryptoDevice](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/certificate-requirements#crypto-device): requires certificates to have a private key protected by a cryptographic device
* [Cpf](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/certificate-requirements#cpf): requires certificates to have a certain Brazilian CPF number

> **Note**
>
> If you need a different requirement, contact us

### CryptoDevice

Use the `CryptoDevice` requirement to restrict users to only choose certificates whose private key are protected by a cryptographic device
(typically a cryptographic token). This requirement does not take an argument.

> **Note**
>
> For ICP-Brasil certificates, this means A3 or A4 certificates only.

### Cpf

Use the `Cpf` requirement to restrict users to only choose certificates having a certain Brazilian CPF number. Pass the CPF on the argument,
with or without punctuation (but *with* leading zeroes).

> **Note**
>
> This requirement has the side effect of improving user experience when using cloud certificates, since the user is not required to type in his
> CPF to check the available cloud certificates (the CPF is inferred from the requirement).