The sign queue

Your party is hosted on the desk's participant node, but the desk never holds your party key — you generate it at registration and keep it. So every ledger effect that needs your signature has to reach you as a prepared transaction you sign yourself.

Almost always, it reaches you as the answer to the call that caused it:

If a call cannot take effect until you sign, it returns the actions in its own response.

Quoting returns your allocations. Accepting a quote (as taker) returns your side of the settlement. Accepting a deposit returns the accept. You sign their hashes and submit them — all of them at once, up to 50 per request — to POST /tx/execute. That is the whole loop, and the Quickstart signer implements it in ~15 lines.

What arrives on its own

Every action comes back from a call of its own, with one exception. As a maker, your committed allocations are the quote, so a won trade needs no further signature. As a taker, the accept hands back your allocations, but the desk keeps driving the trade until it settles: an allocation it could not queue at accept time (a registry hiccup), or a fresh one replacing an action that expired unsigned or was lost to a desk restart, reaches you only as sign.requested and in GET /tx/pending. So until trade.settled or trade.failed, a taker signs whatever arrives for its trade.

The queue is also your recovery path

Everything returned inline is also queued. If a response is lost to a timeout, a crash, or a retry you never saw the answer to, GET /tx/pending still has it — polling it is always safe and returns {actions: []} when there is nothing to do. Re-accepting the same deposit hands back the action already pending, never a duplicate. Re-quoting is different: it replaces the quote, so the old quote's unsigned actions are dropped and the new one returns fresh ones. A second withdrawal of an instrument while one awaits your signature is refused (409).

Rules that bite

• hash is base64 of raw bytes. Decode the base64 first, sign those bytes, then base64-encode the signature. The only string signed as plain UTF-8 text anywhere in this API is the key-rotation challenge.
• Batch results are per-action. POST /tx/execute with a signatures array answers 200 with one {actionId, status} per entry, and a failure does not abort the rest. Partial success is ordinary — check each status, not just the HTTP code. After a timed-out execute, check GET /tx/pending before resending: entries that already executed answer error on a blind retry (see Error handling).
• Actions expire after 10 minutes — sooner when their flow dies first (a quote's actions go with the quote at its validUntil). Nothing breaks: an unsigned quote was never visible; an accepted trade gets a fresh allocation in place of an expired one until its settlement window closes, then fails with nothing moved; re-accept a deposit to get its action again.
• An unsigned quote does not exist for the taker. Until every action the quote returned is signed, your quote is unanchored and invisible — see Quotes live on the ledger.