E-signature webhooks — automate the post-signed flow

Webhooks are the secret weapon of e-signature integration. Every lifecycle event (sent, viewed, signed, completed, voided) fires a webhook your system can handle.

Common webhook flows

### Auto-file to CRM On signer 1 completion → post signed PDF to Salesforce opportunity attachment.

### Trigger payment On envelope completion → call Stripe API to capture payment authorization.

### Provision service On signed SaaS agreement → call your provisioning system to activate customer account.

### Notify team On envelope signed → post to Slack #sales-closed channel.

### Update records On signed HR offer → update ATS status to "hired", trigger onboarding workflow.

Webhook security

Webhooks should be:

1. HMAC-signed — platform includes a signature header; you verify with shared secret 2. HTTPS only — never accept webhooks over HTTP 3. Idempotent — same webhook can fire twice; your handler should deduplicate 4. Retry-aware — platform retries on failure; you should return 200 OK quickly

SignBolt webhook lifecycle events

SignBolt fires webhooks for:

• envelope.sent — envelope created and sent to signers
• envelope.viewed — signer opened the document
• envelope.signed — individual signer completed
• envelope.completed — all signers done
• envelope.declined — a signer refused to sign
• envelope.voided — sender cancelled
• envelope.expired — document expired before all signatures

Implementation example (Node.js)

```javascript app.post('/webhooks/signbolt', async (req, res) => { // Verify HMAC signature const signature = req.headers['x-signbolt-signature']; const expected = hmacSha256(req.body, process.env.WEBHOOK_SECRET); if (signature !== expected) return res.status(401).send();

// Idempotency check const eventId = req.body.event_id; if (await eventAlreadyProcessed(eventId)) return res.status(200).send();

// Handle event switch (req.body.type) { case 'envelope.completed': await fileSignedDocument(req.body.envelope_id); await notifySlack(req.body); break; // ... }

res.status(200).send(); }); ```

Dead letter queue

Platform should retry failed webhooks with exponential backoff. SignBolt retries 7 times over ~2 minutes, then dead-letters to your account's DLQ for manual replay.

Next

• SignBolt webhook docs
• Webhook testing with ngrok