How to add e-signatures
in C# (.NET)

Exchange your OAuth2 client credentials for a short-lived access token using .NET's built-in HttpClient — no NuGet package needed.

using System.Net.Http;
using System.Text.Json;

var http = new HttpClient();

var tokenResp = await http.PostAsync(
    "https://api.getsigned.app/oauth/token",
    new FormUrlEncodedContent(new Dictionary<string, string> {
        ["grant_type"]    = "client_credentials",
        ["client_id"]     = Environment.GetEnvironmentVariable("GETSIGNED_CLIENT_ID")!,
        ["client_secret"] = Environment.GetEnvironmentVariable("GETSIGNED_CLIENT_SECRET")!,
    })
);

var tokenDoc = JsonDocument.Parse(await tokenResp.Content.ReadAsStringAsync());
var token    = tokenDoc.RootElement.GetProperty("access_token").GetString()!;

Upload the PDF and declare signers and fields with MultipartFormDataContent — the .NET equivalent of a multipart/form-data request.

var pdfBytes = await File.ReadAllBytesAsync("nda.pdf");

var signers = JsonSerializer.Serialize(new[] {
    new { name = "Jamie", email = "jamie@client.io" }
});
var fields = JsonSerializer.Serialize(new[] {
    new { type = "signature", page = 1, x = 420, y = 580 }
});

using var form = new MultipartFormDataContent();
form.Add(new ByteArrayContent(pdfBytes)
    { Headers = { ContentType = new("application/pdf") } },
    "document", "nda.pdf");
form.Add(new StringContent(signers), "signers");
form.Add(new StringContent(fields),  "fields");

http.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);

var envResp = await http.PostAsync(
    "https://api.getsigned.app/v1/envelopes", form);
var envDoc  = JsonDocument.Parse(await envResp.Content.ReadAsStringAsync());
var envId   = envDoc.RootElement.GetProperty("id").GetString()!;

Sending generates a tokenized, single-use link per signer and emails it. Signers verify identity with email/SMS OTP.

await http.PostAsync(
    $"https://api.getsigned.app/v1/envelopes/{envId}/send",
    null
);

When the last signer finishes, GetSigned POSTs envelope.completed to your ASP.NET Core endpoint. Verify the HMAC-SHA256 signature before trusting the payload.

// Program.cs — minimal API
app.MapPost("/webhooks/getsigned", async (HttpRequest req) =>
{
    using var reader = new StreamReader(req.Body);
    var raw = await reader.ReadToEndAsync();   // raw body, before parsing
    var sig = req.Headers["X-GetSigned-Signature"].ToString();

    var secret = Environment.GetEnvironmentVariable("GETSIGNED_WEBHOOK_SECRET")!;
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var expected = Convert.ToHexString(
        hmac.ComputeHash(Encoding.UTF8.GetBytes(raw))).ToLowerInvariant();
    // FixedTimeEquals is constant-time
    if (!CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(sig)))
        return Results.Unauthorized();

    using var doc = JsonDocument.Parse(raw);
    var root = doc.RootElement;

    if (root.TryGetProperty("event", out var evProp)
        && evProp.GetString() == "envelope.completed")
    {
        var envelopeId = root.GetProperty("envelope_id").GetString();
        // GET /v1/envelopes/{envelopeId}/document -> sealed PDF
        // Persist, notify parties, update your database, etc.
    }

    return Results.Ok();
});