EGKits ETA Signing Agent

Install the token middleware so the certificate appears in Personal Certificates.

Open ETA → Signing devices in EGKits and create a registration key for this computer.

Decide client (workstation tray) vs server (Windows service) deployment.

Download the official MSI. Prefer x86 when the token CSP is 32-bit (ePass2003). Use x64 or ARM64 only when the middleware ships a matching provider.

Client: run the MSI (or msiexec /i EGKits.EtaSigningAgent-{version}-win-x86.msi).

Server: msiexec /i ... INSTALLMODE=server

Own web address: msiexec /i ... ALLOWEDORIGINS=https://erp.example.com (separate several with semicolons; kept on upgrade).

Silent: append /qn /norestart. Accept the installation terms in the wizard when installing interactively.

Open EGKits Signing Agent Console from the Start Menu (or double-click the tray icon). Choose Restart as administrator in the header for registration, PIN, scan, and settings actions.

Register the computer from the console's Agent & Connection Settings page, or right-click the tray icon → Register device… (or run EGKits.EtaSigningAgent.exe --register <key> as administrator).

Set the token PIN for each company's token from the console or the tray icon → Set token PIN… (or pipe the PIN to --set-pin <tax number>).

On the console Dashboard, confirm the agent, server connection, token, and certificate are healthy, then check the computer shows as Active on the Signing devices page.

Choose in ETA configuration whether invoices are signed automatically and whether signed invoices are submitted automatically.

Prefer Agent:CertificateThumbprint to select the token certificate; set Pkcs11ModulePath for ePass2003-style tokens.

Client-side signing: keep LocalBridgeEnabled true; farm hosts should disable the bridge.

Open the console's Diagnostics & Logs page for the live log, a self-test, and a redacted diagnostic bundle to send to support.

If the console says it cannot reach the agent, start EGKits ETA Signing Agent from the Start Menu (or start the Windows service on servers).

If an action is refused as needing administrator rights, use Restart as administrator in the console header.

Check %ProgramData%\EGKits\EtaSigningAgent\logs\agent-YYYYMMDD.log for startup and signing errors, and security-events.log for refused or audited console requests.

Run EGKits.EtaSigningAgent.exe --test-token to check the token, PIN and certificate without signing an invoice.

If the PIN dialog still appears, verify PKCS#11 module path (32-bit DLL for the x86 agent).

If the device shows as Revoked, create a new registration key and register the computer again.

Download the newer MSI. Installing a different architecture replaces the previous one (they share an UpgradeCode).

Run the new MSI. Operator-edited appsettings.json is not overwritten.

Upgrading to 1.2.0 adds the Signing Agent Console and its Start Menu shortcut; device registration, token PINs, and settings carry over unchanged.

Upgrading from 1.0.x: register the computer on the Signing devices page. A TokenPin left in appsettings.json is moved to the encrypted store at first start; then clear it from the file.

Restart the tray agent or Windows service after the upgrade if it does not restart by itself.

Open Windows Settings → Apps and uninstall EGKits ETA Signing Agent, or msiexec /x the MSI /qn /norestart.

The installer stops the tray agent and the console, and removes the Windows service and Start Menu shortcuts.

appsettings.json is removed with the program folder; token certificates in Windows remain. Logs and the encrypted store under %ProgramData%\EGKits\EtaSigningAgent are kept; revoke the computer on the Signing devices page.