E-Signature
Connect Dropbox Sign
E-signature on your quotes, with a lighter setup than DocuSign.
Overview
Dropbox Sign + TackQuote
Dropbox Sign (formerly HelloSign) is TackQuote's lighter-weight e-signature path: a single platform API key, no RSA key or JWT-assertion plumbing. TackQuote uploads the quote PDF as an embedded signature request and returns a short-lived signing URL, so the buyer signs in the flow they are already in rather than on a page you do not control. Callbacks are verified against the event_hash Dropbox Sign ships on every payload, and because that hash only covers the event time and type, TackQuote deliberately matches quotes on the signature-request id it stored itself and never on attacker-influenceable title text. A completed request advances the quote to approved and writes a quote.signed event; declines and voids are handled as their own terminal outcomes.
Dropbox Sign runs on a single platform-level API key with embedded signing enabled, so tenants do not register their own OAuth app. Enable it per workspace and send.
Before you start
What you'll need
- Dropbox Sign account with API access and embedded signing enabled
- A generated quote PDF to send for signature
- Dropbox Sign account callback URL pointed at TackQuote
- Workspace admin access to enable the connector
Setup
How to connect Dropbox Sign
Enable Dropbox Sign for your workspace
In TackQuote Settings → E-Signature → Dropbox Sign, turn the connector on. TackQuote verifies the platform credentials rather than reporting a connection it has not tested.Point Dropbox Sign callbacks at TackQuote
Configure the Dropbox Sign account callback URL to TackQuote's webhook endpoint so signature events arrive and can be verified.Send a quote for signature
From a sent quote, request signature. TackQuote uploads the quote PDF, creates the embedded request, and returns the signing URL.Let the signature close the loop
On completion the verified callback approves the quote and stamps the request id, status, and signed-at timestamp onto it.
Capabilities
What you get
Embedded Signature Requests
TackQuote creates an embedded signature request from the quote PDF and returns a short-lived signing URL for the buyer — not just an emailed link.
Signed Means Approved
A completed request advances the quote from sent, viewed, or negotiating to approved and records a quote.signed event. Declines and voids resolve the quote instead.
Verified, And Honest About Its Limits
Every callback's event_hash is verified. Because that hash covers only the event time and type, quotes are matched on the stored signature-request id and never on payload text.
Progress Without False Promotion
Intermediate events like sent and viewed update the request status on the quote but never move its lifecycle. Only completion approves.
FAQ
Dropbox Sign questions
How is this different from the DocuSign connector?
Functionally they do the same job — quote PDF out, embedded signing URL back, completion approves the quote. Dropbox Sign is a simpler setup (an API key rather than JWT Grant with an RSA key), and its callbacks are verified with event_hash instead of a full-body HMAC.
Do declined or cancelled requests change the quote?
Yes, as their own terminal outcome — a decline or void resolves the quote rather than leaving it waiting. Quotes already in a terminal state are left alone.
Is the signing link safe to share?
It is short-lived by design. TackQuote requests a fresh embedded sign URL rather than storing a long-lived public link.