SignMaster and Make, through a custom webhook

Before you start

You need SignMaster on Crew or Company, where webhooks are included, a Make account, and a template with clearly labeled fields. Labels like Customer name and Job address are what you'll see when you map values in Make.

Set it up

1. 1

   Add the trigger

   In a new scenario, add the Webhooks app and choose the Custom webhook module.

2. 2

   Create the webhook

   Next to Webhook, choose Add, name it something like SignMaster completed, and choose Save. Make generates the address and starts listening. Copy the address.

3. 3

   Add it in SignMaster

   In Settings › Developers › Webhooks, add an endpoint with that address and tick the events this scenario handles, such as envelope.completed. Keep the signing secret SignMaster shows once.

4. 4

   Teach Make the structure

   Make learns the data structure from the first request it receives. SignMaster's test message carries no field values, so while Make is listening, sign a test contract made from your template. Its labels then become fields you can map.

5. 5

   Add your modules

   Add the next module, such as Google Sheets Add a Row or Airtable Create a Record, map the values, then switch the scenario on.

6. 6

   When the template changes

   Added a field? Open the webhook module, choose Detect new values, and sign another test contract so Make picks it up.

What to map

• Answers: open data, then fields_by_label. Each labeled field in your template appears under its own label, with the value the signer or you entered.
• People: on recipient.completed, data, then recipient, is the person who just finished. data, then recipients, lists everyone, and an Iterator can walk through it.
• The signed PDF: data, then signed_pdf, then url works for 24 hours. Download it with Make's HTTP app and upload it to your storage in the same run.
• The event: type says which event arrived, so one scenario can handle several with a Router and a filter on type.

Delivery and security

Make replies Accepted as soon as a message is queued, which SignMaster counts as delivered. If Make answers with an error, for instance because the queue is full, SignMaster retries after 1 minute, then 5 minutes, and so on up to 24 hours.

Anyone who knows a webhook address can post to it, so keep yours private. To prove a message came from SignMaster, turn on Get request headers in the module's advanced settings and compare the SignMaster-Signature header against an HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with your secret. That's worth doing before a scenario moves money or changes customer records; a simple Slack alert can usually do without it.