Authentication for Callbacks: JWT & OAuth 2.0 👑

💡 At a Glance

The OAuth for Callbacks feature allows securing the communication between sproof Sign and external systems for automatic status notifications. Plan admins can configure authorization headers for callback URLs that are stored with signature requests. This ensures that the transmitted data is tamper-proof and can be unambiguously verified by the recipient system.

📑 Step-by-Step Guide

JWT Generation via Shared Secret

To secure the integrity of status notifications using a shared secret, plan admins should proceed as follows:

1. Click the green GENERATE NEW SECRET button in the OAuth for callbacks section to create a secret key.

2. For each callback request, sproof Sign automatically generates a JWT and signs it with this shared key (HMAC-SHA256). The signed JWT is sent as a Bearer token in the Authorization header of the POST request.

3. The recipient system must validate the JWT signature using the same shared secret and the HS256 algorithm.

Identity Provider (IDP) Configuration

If an external Identity Provider (IDP) is used for securing, it can be configured in the lower section. The OAuth 2.0 Client Credentials Grant Flow is used for this. Ensure that this flow is enabled for the configured client in the IDP.

1. Enter the required address into the mandatory Authorization Server URL field.

2. Enter the corresponding credentials into the mandatory Client ID and Client Secret fields.

3. Enable Include Custom Parameters to send additional parameters (e.g., scope or audience) to the authorization server's token endpoint.

4. Finally, click the green SAVE button to activate the IDP configuration for all future callback calls in the plan.

Last updated: August 19, 2026