Glossary
Webhook
TL;DR
Webhooks follow a push model: instead of your application repeatedly asking 'is the document signed yet?', the e-signature provider tells you the moment it happens. You register a URL, and the provider sends event data to that URL as a JSON payload.
**Common e-signature webhook events**
• document.sent — document was sent to the recipient • document.viewed — recipient opened the signing link • document.signed — recipient completed signing • document.declined — recipient refused to sign • document.expired — signing deadline passed
**Why webhooks matter for production systems**
Polling is wasteful and unreliable. A webhook delivers the event in real-time (typically within 1-5 seconds), letting you trigger downstream workflows immediately: update a CRM, start an onboarding flow, process a payment, or notify a team.
**Webhook security**
Always verify webhook authenticity. Most providers include an HMAC signature in the request headers. Your server should verify this signature before processing the event. Also: use HTTPS, respond with 200 within 5 seconds (process asynchronously), and make handlers idempotent since webhooks may be retried.
**Provider comparison**
DocuSign calls their webhook system 'Connect' and requires dashboard configuration. HelloSign uses callback URLs. Signbee sends webhook notifications to any registered URL with HMAC verification headers.
Related terms
Further reading
Related resources
Try Signbee — e-signatures via API.