Signatoro webhooks: get an event when a signature or a team changes

Signatoro posts an event to a URL you choose when something changes, so a CRM, a spreadsheet, an n8n or Zapier workflow or your own app can follow along without asking the API on a schedule. Add an endpoint on the Connect page, under Automations, on every plan.

Which events you get

An endpoint on your own account gets your signature's events. A company owner can also add an endpoint for the company, which gets every member's signature and the team's changes.

What each event looks like

Every event is a JSON POST with the same envelope:

{
  "id": "evt_6f1c2b0e9d7a4c1f8e3b5a2d4c6e8f0a",
  "type": "signature.updated",
  "created_at": "2026-11-03T10:00:00.000Z",
  "account_id": "the account the endpoint belongs to",
  "data": {
    "person": { "id": "...", "name": "Maya Okafor", "email": "maya@northwind.example" },
    "company_id": "...",
    "signature": {
      "html": "<table>...</table>",
      "text": "Maya Okafor\nHead of Sales, Northwind\n...",
      "fingerprint": "3f2a..."
    }
  }
}

signature.html and signature.text are the same signature the API and the MCP server return. fingerprint changes only when the signature does, so you can skip an event whose fingerprint you already have.

Member events carry company_id and email; member.joined and member.removed for a member also carry person with their id and name.

Check that an event came from Signatoro

When you add an endpoint, Signatoro shows its signing secret once (whsec_...). Each event carries a Signatoro-Signature header:

Signatoro-Signature: t=1793700000,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

v1 is an HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your secret. Check it before you trust the event, and refuse one whose timestamp is more than five minutes old. In Node:

import { createHmac, timingSafeEqual } from 'node:crypto';

function fromSignatoro(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.split('=')),
  );
  const age = Math.abs(Date.now() / 1000 - Number(parts.t));

  if (age > 300) return false;

  const expected = createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`)
    .digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');

  return given.length === expected.length && timingSafeEqual(given, expected);
}

Use the body exactly as it arrived; parsing and re-serializing the JSON changes it.

Delivery

• Answer with any 2xx status within 10 seconds. Signatoro does not read the response body.
• A timeout, a network error, a 429 or a 5xx is tried again after 2 and then 8 more seconds. Other 4xx answers are not retried.
• Redirects are not followed: give the final URL.
• The URL must use https and a public address.
• Events can arrive more than once or out of order. Use id to drop repeats and created_at to order them.
• The Connect page shows the last delivery for each endpoint, and "Send test" sends a webhook.test event at once (one every 10 seconds).
• An account can have up to 5 endpoints.

For agents

To react to a signature change, ask the person to add an endpoint on the Connect page (Automations tab) and keep the secret it shows. Check the Signatoro-Signature header on every event, and fetch the signature from the API at send time as before: signature.updated tells you it changed, the API stays the source for each email.