DocuSign Connect carries the org in its path and verifies that org's key first

Shipped

November 8, 2026 at 3:51 AM UTC

Author

Kamo

Commit

8621114

The Connect address is public on the shared API host, which cannot tell orgs apart, so envelopes now send **************** (shared-lib VendorWebhookUrls). The listener 404s an org without a DocuSign connection, verifies the HMAC against THAT org's Connect key before reading the body (401 otherwise), and only syncs that org's envelope. Envelopes sent with the old org-less address keep updating through EsignStatusPoller. mlos.esign.webhook-public-base is set explicitly.