Subscribe to and verify Box Sign webhook events via Box Webhooks v2

Steps

1. Generate webhook signature keys for your Box application in the Developer Console (a primary key, optionally a secondary key for rotation).
2. Create a standard Box Webhooks v2 subscription with a target type of file or folder — typically the folder where sign requests are created — and triggers such as SIGN_REQUEST.COMPLETED, SIGN_REQUEST.DECLINED, SIGN_REQUEST.EXPIRED, SIGN_REQUEST.SIGNER_SIGNED, SIGN_REQUEST.SIGNATURE_REQUESTED, or SIGN_REQUEST.ERROR_FINALIZING.
3. On receipt, read the delivery-timestamp and primary/secondary signature headers; reject the payload if the timestamp is more than 10 minutes old.
4. Compute HMAC-SHA256 over the raw payload body bytes followed by the timestamp bytes, once per configured key, base64-encode each digest, and compare (timing-safe) against the primary and secondary signature headers; trust the payload if at least one matches.
5. Prefer the official Box SDK's built-in webhook-signature verification helper over hand-rolled HMAC comparison where available.