Dropbox Sign setup guide

Agents prepare documents and send them for signature.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Dropbox Sign, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Dropbox Sign can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

API key

API key.

1. Sign in to Dropbox Sign as the person the agent should send as and open the API settings page (https://app.hellosign.com/home/myAccount?current_tab=integrations#api).
2. Generate an API key, name it (for example Everdeck) and copy it.
3. Paste the key into the form. Legally binding requests need a paid Dropbox Sign API plan (Essentials or higher). Without one, the agent can only send test requests, which are watermarked and not binding.
4. You don't need to set an account callback URL: live updates from Dropbox Sign aren't available yet, so leave the callback field as it is. Instead, the all_signed and declined triggers on the Intake page check every 15 minutes for requests you sent in the last 90 days that were completed or declined; a bounced email address can't be picked up yet.

Field	What to enter
API key	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Dropbox Sign until you delete or rotate it there.

Your Dropbox Sign API app

Your OAuth app.

This way signs in with an OAuth app you create for Dropbox Sign, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. Use this method only if you cannot share an API key: through OAuth the agent sees only the signature requests sent through your API app, not the ones your team sends from the Dropbox Sign website or with an API key. Create an API app at https://app.hellosign.com/oauth/createAppForm and set its OAuth callback URL to https://everdeck.io/api/oauth/callback.
2. Under OAuth scopes, tick Account Access, Signature Request Access and Template Access. These scopes charge the plan of the person who connects, which is you.
3. Copy the app's Client ID and Client Secret into the form, then connect and sign in as the app's owner. Dropbox Sign requires OAuth apps to pass its production approval (a support-assisted review with a demo video) before production use; until then only the owner can authorize the app, for building and testing.
4. You don't need to set an account callback URL: live updates from Dropbox Sign aren't available yet, so leave the primary API key empty. Instead, the all_signed and declined triggers on the Intake page check every 15 minutes for requests sent through your API app in the last 90 days that were completed or declined.

Field	What to enter
Primary API key of your account (optional, not used yet)	A secret: Everdeck saves it encrypted and never shows it again. Live updates from Dropbox Sign aren't available yet; leave this empty.

Disconnecting deletes the tokens Everdeck saved. Dropbox Sign documents no revocation endpoint: remove the app in its API settings.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Find signature requestsTier 0 · ReadReads outside contentdropbox_sign_list_signature_requests

  List signature requests you sent or received (not ones you were only copied on), optionally filtered with a search query. Returns each request's id, title, whether it is complete, declined or failed, and each signer's status.

• Read a signature requestTier 0 · ReadReads outside contentdropbox_sign_get_signature_request

  Read one signature request: each signer's status (awaiting_signature, signed, declined with reason), when they last viewed it or were reminded, and the values filled into its fields.

• Find templatesTier 0 · ReadReads outside contentdropbox_sign_list_templates

  List the templates you can use, optionally searching by title. Returns each template's id, title, signer roles (in signing order) and copy (CC) roles. A locked template (is_locked) is outside the plan's template quota and can only send test requests.

• Read a templateTier 0 · ReadReads outside contentdropbox_sign_get_template

  Read a template's signer and CC roles and its documents' fields, including the merge fields (custom fields) you can pre-fill when sending. Call this before send_with_template.

• Send from a templateTier 3 · ExternalReads outside contentdropbox_sign_send_with_template

  Send a signature request built from a template. Each signer role gets a person; Dropbox Sign emails them right away. Set test_mode for a non-binding test (required on accounts without a paid API plan).

• Send a file for signatureTier 3 · ExternalReads outside contentdropbox_sign_send_document

  Send one or more files (PDF, Word and other common formats) for signature from links Dropbox Sign can download. Without text tags, Dropbox Sign adds a signature page that every signer signs; with use_text_tags, tags in the document such as [sig|req|signer1] and [date|req|signer1] place the fields. Signers are emailed right away.

• Remind a signerTier 3 · ExternalReads outside contentdropbox_sign_send_reminder

  Email a signer a reminder to sign. Not allowed within an hour of the last reminder (manual or automatic), or for embedded requests.

• Fix a signer's email addressTier 3 · ExternalReads outside contentdropbox_sign_update_signer_email

  Change a signer's email address, for example after it bounced, and send the request to the new address. The signer gets a new signature_id. Not possible for requests sent with an appended signature page (send_document without text tags).

• Cancel a signature requestTier 4 · Money or irreversibleReads outside contentdropbox_sign_cancel_signature_request

  Cancel a sent request that not everyone has signed yet; signers can no longer sign. This cannot be undone. Cancellation finishes in the background and is confirmed by a signature_request_canceled event.

• Save the signed PDFTier 0 · ReadReads outside contentdropbox_sign_download_files

  Download a signature request's documents as one PDF, save it to the company's files and return its text. Final files are ready shortly after everyone signs; try again later if they are still being prepared.

What can start work

These events from Dropbox Sign can become tasks for your agents through Intake. How Intake works.

Every signer completed a signature request you sent in the last 90 days (checked every 15 minutes).

Connect Dropbox Sign first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A signer declined a signature request you sent in the last 90 days, with a reason (checked every 15 minutes).

Connect Dropbox Sign first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Dropbox Sign later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Dropbox Sign, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.