Dropbox Sign
Connect Dropbox Sign to send documents for signature, track and manage requests, download signed PDFs, and use templates.
You paste one Dropbox Sign API key into PopMCP, plus the word "test" in the Key type box if it came from a free test-mode API account.
Paid plan required before this connector works
Production (legally binding) signature requests require a paid Dropbox Sign API plan, and any embedded or OAuth integration must additionally pass Dropbox Sign's app approval review before it can leave test mode.
- Typical wait
- Paid plan: instant on purchase. App approval: no SLA published by Dropbox Sign - the docs state no timeframe; submissions are worked through with an API support specialist, so budget days, not minutes
- Cost
- App approval is free; production use requires a paid Dropbox Sign API plan (API plans are sold separately from the standard eSignature seat plans - see sign.dropbox.com pricing for current tiers)
- Blocked until approved
- Any non-test request. Without a paid API plan the API returns HTTP 402 on production calls, and embedded signing/requesting/templates and OAuth flows stay locked to test mode until the app is approved. Test-mode signature requests are watermarked and are not legally binding.
- Works meanwhile
- Everything, in test mode: an API key from the account's API settings works immediately, and test_mode=1 on requests (plus testMode / skipDomainVerification in the embedded client.open() call) exercises the full flow including endpoints otherwise restricted to paid plans. Dropbox Sign explicitly allows completing app approval before buying a plan.
Where to apply: Dropbox Sign API dashboard: create the API app, then use Support Assisted Approval from the 'Submitting for approval' guide at developers.hellosign.com/docs/guides/app-approval/submitting. Purchase the API plan from the account's billing/API plan page.
- Plain (non-embedded) signature-request workflows do NOT need app approval at all - only Embedded Signing, Embedded Requesting, Embedded Templates and OAuth apps do. Do not assume the review applies to you.
- Approval and payment are separate gates: an approved app still returns 402 until a paid API plan is active.
- Reviewers want to see a complete, working end-to-end user experience - a half-built demo is what stalls submissions.
- Domain verification matters for embedded flows: dropping skipDomainVerification without verifying the domain produces warning pop-ups in the iframe.
- Setup time
- 3 min
- Auth
- API credentials
- API base URL
- https://api.hellosign.com/v3
Before you begin
- Dropbox Sign account. Sign up free at app.sign.dropbox.com.
- Account owner or an admin who can see the API tab. Ordinary team members cannot reveal keys.
- A paid API plan (Essentials or above) if you need real, legally binding signature requests. The free API tier is test mode only.
Get your credentials
Open your API settings
Sign in at app.sign.dropbox.com, then click API in the left sidebar. The API settings page opens at app.hellosign.com/home/myAccount#api.
Settings
Keys, apps, callbacks and usage for your integrations.
| Name | Value | Created (UTC) | Last used (UTC) | Primary key |
|---|---|---|---|---|
| Untitled KeyOwner: ops@acme.com | a1b2••••••••••••••••4a2f | Mar 4, 2026, 7:37 PM | 11:05 AM | Yes |
You sign in at app.sign.dropbox.com, but the API settings page itself is served from app.hellosign.com.
Create or reveal your API key
Under API key, click Create Key for a new key, or Reveal Key to show an existing one.
API key
| Name | Value | Created (UTC) | Last used (UTC) | Primary key |
|---|---|---|---|---|
| PopMCPOwner: ops@acme.com | a1b2••••••••••••••••4a2f | Mar 4, 2026, 7:37 PM | Never | Yes |
Create a key dedicated to PopMCP so you can revoke it without breaking other integrations.
Copy the key into PopMCP
Click Reveal Key, copy the full string, and paste it into PopMCP's API key field.
API keys
PopMCP sends the key as the HTTP Basic username with an empty password.
Set the Key type
Type test in PopMCP's Key type field if the account is on the free API tier. Leave it blank, or type live, on a paid Essentials, Standard or Premium API plan.
Connect in PopMCP
Open your workspace, choose Dropbox Sign in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| API keysecret | Dropbox Sign → Settings → API → API Keys → copy your API key (or create one). Stored encrypted; used server-side only via HTTP Basic auth.Encrypted with AES-256-GCM on save and never shown again. |
| Key typetext | Enter "test" if this is a free/sandbox API key. Sandbox keys can ONLY create test (non-binding) signature requests, so the connection will auto-send everything in test_mode for you. Leave blank (or "live") for a paid API plan key that sends real, legally-binding documents. |
PopMCP verifies the credential against Dropbox Sign immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the Dropbox Sign connector as Connected with your account email. Listing signature requests returns real request IDs, and anything created on a test key comes back flagged as test mode.
Troubleshooting
401 Unauthorized
Why: The key was mistyped or truncated, or it was deleted from Settings, API.
Fix: Reveal the key again in Settings, API, and paste the whole string. If it is gone, click Create Key and use the new one.
Upgrade required, or non-test requests rejected
Why: The account is on the free API tier, which can only create test signature requests that are not legally binding.
Fix: Enter "test" as the Key type so PopMCP sends everything in test mode, or upgrade to an Essentials or higher API plan.
Documents arrive watermarked as a test and cannot be legally signed
Why: Key type is still set to "test" on a paid plan.
Fix: Clear the Key type field, or set it to "live", and reconnect.
You cannot see the API tab at all
Why: You are signed in as a team member rather than the account owner or an admin.
Fix: Ask the account owner to reveal the key, or to grant you admin rights on the Dropbox Sign team.
Revoking a key broke other tools
Why: Keys never expire and cannot be moved between accounts, so a shared key is often reused across integrations.
Fix: Issue a separate key per integration and rotate them one at a time.