> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL. > > Documentation indexes by section: > - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt > - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt > - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt > - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt > > Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth > Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks > > OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json > MCP server: https://docusign.docs.buildwithfern.com/_mcp/server # Validation and security > Learn about your options for validating webhook notification messages and other Docusign Connect security options. With webhooks, the client is Docusign and your listener application is the server. But how does your listener application know that an incoming message came from Docusign and not from an attacker who is trying to spoof your application? Docusign offers several features for authenticating notification messages, each which can be used in any combination. * **OAuth for Connect** can authenticate that the Connect notification messages your app receives are from Docusign. OAuth for Connect uses the [Client Credentials](https://www.rfc-editor.org/rfc/rfc6749#section-4.4) OAuth grant flow, which is a server-to-server authentication workflow that interfaces with your existing OAuth implementation. See [OAuth for Docusign Connect](/platform/webhooks/connect/validation-and-security/oauth-connect) for details. * **HMAC Security** adds special header values to your Docusign connect messages based on keys known only to Docusign and your app. By using the keys to decrypt these headers, your app can verify That the message was sent by Docusign Connect (authenticity) and that the message contents are exactly the same as they were at the time of sending (integrity). HMAC authentication is available for all types of Connect configurations but the Connect feature must be enabled to use HMAC with envelope Connect. See [Using HMAC Security with Docusign Connect](/platform/webhooks/connect/hmac) for details. * **Basic authentication** adds a header containing a username and password to the message header. When you receive a message that contains this header, you should validate the provided username/password combination to ensure security. This feature is simple to set up and effective for repelling many types of attacks at an early stage in the HTTPS POST process. A name and password are configured for the Connect configuration that matches your listener’s configuration, too. The name and password are not sent as cleartext since they are encrypted by the HTTPS/TLS protocol. Basic authentication is only available for Account and Recipient Connect, and cannot be used with OAuth for Connect. **Note**: Basic authentication for Connect is different from legacy username/password authentication. Your apps can continue to use basic authentication for Connect regardless of the [OAuth 2.0 requirements and migration](/platform/auth/oauth2-requirements-migration) rules for getting access tokens. * **Mutual TLS authentication** ensures that traffic is secure and trusted in both directions between a client and server. Mutual TLS is initiated and controlled by the listener app, enabling your app to request that Docusign send its PKI certificate to your application as part of the HTTPS TLS handshake protocol. Your app can then validate and authorize the Docusign certificate. Mutual TLS is often difficult to configure and must be updated when the Docusign certificate is renewed every year or so. As a best practice for apps in production, use both HMAC and OAuth 2.0 to secure your messages. ## Response headers Docusign Connect response messages are sent with a set of validation headers. You can use these headers to validate that the messages were sent by Connect and to ensure that they are secure. | Header | Description | | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `User-Agent` | Used by non-SOAP endpoints to Identify the message sender. For Connect messages, this value will always be “`docusign`”. | | 
                                                                           | Used for [HMAC security](/platform/webhooks/connect/hmac) validation. If you have configured at least one HMAC key for your account, your Connect messages will include that many `X-DocuSign-Signature-N` headers. For example, if you have two HMAC keys configured, your message will include the `X-DocuSign-Signature-1` and `X-DocuSign-Signature-2` headers. You can validate that Docusign is the message sender using the procedure documented by [How to validate a webhook message using HMAC](/platform/webhooks/connect/validate). |
| [Authorization](/platform/webhooks/connect/validation-and-security/oauth-connect) | An access token from your IDP/Auth Server, if one is required, with the prefix “`Bearer`”.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

Additional headers can be included if you have enabled HMAC security. See [Using HMAC Security with Docusign Connect](/platform/webhooks/connect/hmac) for details.

## Next steps

* [OAuth for Docusign Connect](/platform/webhooks/connect/validation-and-security/oauth-connect)
* [Using HMAC Security with Docusign Connect](/platform/webhooks/connect/hmac)
* [How to validate a webhook message using HMAC](/platform/webhooks/connect/validate)