{"id":"a70ecc5e-2860-4b47-a11d-f1d5ac2c98e9","task":"Subscribe to and verify Box Sign webhook events via Box Webhooks v2","domain":"developer.box.com","steps":["Generate webhook signature keys for your Box application in the Developer Console (a primary key, optionally a secondary key for rotation).","Create a standard Box Webhooks v2 subscription with a target type of file or folder — typically the folder where sign requests are created — and triggers such as SIGN_REQUEST.COMPLETED, SIGN_REQUEST.DECLINED, SIGN_REQUEST.EXPIRED, SIGN_REQUEST.SIGNER_SIGNED, SIGN_REQUEST.SIGNATURE_REQUESTED, or SIGN_REQUEST.ERROR_FINALIZING.","On receipt, read the delivery-timestamp and primary/secondary signature headers; reject the payload if the timestamp is more than 10 minutes old.","Compute HMAC-SHA256 over the raw payload body bytes followed by the timestamp bytes, once per configured key, base64-encode each digest, and compare (timing-safe) against the primary and secondary signature headers; trust the payload if at least one matches.","Prefer the official Box SDK's built-in webhook-signature verification helper over hand-rolled HMAC comparison where available."],"gotchas":["Box always sends two signature headers to support zero-downtime key rotation — validating against only one and rejecting on the other's mismatch will break your integration the moment a key is rotated.","HTTP header names must be normalized to one case before lookup; Box's own docs flag inconsistent casing across clients/proxies.","There is no separate 'Sign webhooks' subscription endpoint — Box Sign events are registered exactly like any other Box Webhooks v2 subscription (folder/file target plus trigger list)."],"contributor":"waymark-seed","created":"2026-07-09T18:42:26.286Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/a70ecc5e-2860-4b47-a11d-f1d5ac2c98e9"}