← Back to eSignature Overview · Core Primitive
The Dropbox Sign (formerly HelloSign) driver for the MemberJunction eSignature subsystem. It implements the BaseSignatureProvider contract against the Dropbox Sign REST API v3, using HTTP Basic authentication with your API key.
npm install @memberjunction/esignature-dropboxsign
You don't call this package directly. You configure a Dropbox Sign Signature Account and use the
SignatureEngine(or the no-code Actions). The engine resolves and drives this provider for you.
| Driver key | DropboxSign |
| Registration | @RegisterClass(BaseSignatureProvider, 'DropboxSign') |
| Authentication | HTTP Basic (API key as username, empty password) |
| API | Dropbox Sign REST API v3 (api.hellosign.com/v3) |
| Webhooks | HMAC-SHA256 verified |
| Operation | Supported |
|---|---|
| Create envelope | ✅ |
| Get status | ✅ |
| Download signed | ✅ |
| Void | ✅ |
| Parse webhook event | ✅ |
| Verify webhook signature | ✅ |
| Templates | — |
| Embedded signing | — |
These values live in the account's Credential (encrypted via the Credential Engine) — never in code or environment variables.
| Key | Required | Default | Description |
|---|---|---|---|
apiKey |
✅ | — | Dropbox Sign API key, sent via HTTP Basic auth. |
restBase |
— | https://api.hellosign.com/v3 |
REST API base. |
testMode |
— | false |
When true, requests are flagged as non-billable test requests. Great for development. |
connectHmacKey |
— | (falls back to apiKey) |
HMAC secret for verifying webhooks. Dropbox Sign signs callbacks with the account API key by default, so this is optional. |
Dropbox Sign supports a first-class test mode that creates non-billable signature requests — ideal for development and CI. Set testMode: true on the account configuration and every request the driver sends is marked test_mode=1. Flip it off for production.
apiKey (and testMode if developing).POST {your-server}/esignature/webhook/DropboxSign.Dropbox Sign reports state two ways: request-level booleans (is_complete, is_declined) and a per-signer status_code. The driver checks the booleans first, then falls back to the lead signer's status_code (defaulting to Sent when none is present). Both map onto MemberJunction's normalized lifecycle:
Request-level (checked first):
| Dropbox Sign flag | MJ EnvelopeStatus |
|---|---|
is_complete |
Completed |
is_declined |
Declined |
Per-signer status_code (fallback):
| Dropbox Sign status | MJ EnvelopeStatus |
|---|---|
awaiting_signature |
Sent |
on_hold |
Delivered |
signed |
Signed |
declined |
Declined |
error, (any unrecognized code) |
Unknown |
| (no signer status present) | Sent |
Dropbox Sign pushes events to POST /esignature/webhook/DropboxSign. Each callback carries an event_hash computed as an HMAC-SHA256 over <event_time><event_type> keyed with your API key (or an explicit connectHmacKey). The driver recomputes and compares it before trusting the event. See the webhook flow.
cd packages/eSignature/Providers/DropboxSign && npm run test
| eSignature overview | The whole subsystem. |
| Core primitive | The contract, engine, and data model this driver plugs into. |
| DocuSign driver · PandaDoc driver | Sibling providers. |