x-docusign-signature-N headers, one per active key. Register the credential on your endpoint and webhook.co verifies every captured request against the exact bytes it received, then records the outcome — with a named reason when it fails.
Get the secret key
Go to Admin → Connect → the Connect Keys tab and choose Add Secret Key, then enable Include HMAC Signature on the Connect configuration itself. See DocuSign’s own webhook documentation for the current steps. The full key is visible only right after you create it — later views show just its first four characters — and deleting a key shifts the index of the keys below it.Register it on your endpoint
How the signature is checked
- Signed message — the raw request body.
- Algorithm — HMAC-SHA256, base64-encoded.
- Key — the signing secret used verbatim (its UTF-8 bytes).
- Signature format — the bare encoded MAC.
- Rotation — more than one candidate signature may be present, and any one of them matching verifies the request. You can roll the credential without dropping events.
What makes this one different
- Multiple signature headers may be present during key rotation; any one matching verifies.
Confirm
verified; one that does not shows failed, with the reason named.