Provider-specific config + decrypted credential values (integrationKey, privateKey, …).
OptionalaccountThe MJ: Signature Accounts.ID this provider instance is bound to, if any.
OptionalaccountHuman-readable account name, for logging.
OptionalconnectShared secret used to verify inbound webhook signatures (e.g. DocuSign Connect HMAC, Dropbox Sign / PandaDoc callback HMAC). Lives in the account's encrypted MJ: Credentials row alongside the other provider secrets — never an environment variable. When absent, strict webhook verification fails closed (the engine rejects the event).
OptionalonInvoked by the provider after an OAuth token refresh so the engine can persist tokens.
Configuration handed to a provider's BaseSignatureProvider.initialize. It is the merge of (provider defaults + account overrides + decrypted credential values), assembled by the engine. Providers read whatever keys they need; unknown keys are ignored.