Today, after an embedded signing session is used, DocuSign redirects back to the developer's application and includes status on what happened (envelope signed or sign later, etc).

But the status can't be relied on since there's no way to know, for sure, that the redirect came from DocuSign (it could be a spoof from a bad guy).

THIS IDEA: in the createRecipientView API call, include an optional hmac_secret attribute. Then that attribute would be used to create an HMAC of the response URL and the HMAC would be included in the redirect URL.

So the redirect URL would look something like:

https://app.example.com/signingResults?event=signing_complete&HMAC=uhieondoid3el9u...

The HMAC would enable verification and give the guarantee that the first part of the URL (https://app.example.com/signingResults?event=signing_complete) really was from DocuSign.

Benefit: this would save making an API call to confirm that the signer really did sign during the embedded signing session.

SCORE-594