[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FA12N90V3HFCB34KARYNWA":3,"skill-same:01M6FA12N90V3HFCB34KARYNWA":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6FA12N90V3HFCB34KARYNWA","documenso-security-basics",null,"Implement security best practices for Documenso document signing integrations.\nUse when securing API keys, configuring webhooks securely,\nor implementing document security measures.\nTrigger with phrases like \"documenso security\", \"secure documenso\",\n\"documenso API key security\", \"documenso webhook security\".","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fjeremylongshore\u002Fclaude-code-plugins-plus-skills\u002Fdocumenso-security-basics\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"security","documenso","documenso security basics","basics","security best practices","saas","api","integrations","read","write","edit","use","code","webhooks","document","webhook","io","trigger","secure","openclaw","2026-11-10 10:12:30",false,"---\nname: documenso-security-basics\ndescription: |\n  Implement security best practices for Documenso document signing integrations.\n  Use when securing API keys, configuring webhooks securely,\n  or implementing document security measures.\n  Trigger with phrases like \"documenso security\", \"secure documenso\",\n  \"documenso API key security\", \"documenso webhook security\".\nallowed-tools: Read, Write, Edit\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\ntags: [saas, documenso, api, security, webhooks]\n\n---\n# Documenso Security Basics\n\n## Overview\n\nEssential security practices for Documenso integrations: API key management, webhook verification, document access control, and self-hosted signing certificate configuration.\n\n## Prerequisites\n\n- Documenso account with API access\n- Understanding of environment variables and secret management\n- Completed `documenso-install-auth` setup\n\n## Instructions\n\n### Step 1: API Key Security\n\n```typescript\n\u002F\u002F NEVER hardcode keys\nconst BAD = new Documenso({ apiKey: \"api_abc123...\" }); \u002F\u002F Exposed in source\n\n\u002F\u002F ALWAYS use environment variables\nconst GOOD = new Documenso({ apiKey: process.env.DOCUMENSO_API_KEY! });\n```\n\n**Key management rules:**\n- Store in `.env` (never committed) or a secrets manager (Vault, AWS Secrets Manager)\n- Use team-scoped keys for team resources, personal keys for personal documents\n- Rotate keys on employee offboarding -- revoke in dashboard immediately\n- CI\u002FCD: use masked\u002Fencrypted secrets (GitHub Secrets, GitLab CI variables)\n\n```bash\n# .gitignore — always include\n.env\n.env.*\n!.env.example\n```\n\n### Step 2: Key Rotation with Zero Downtime\n\n```typescript\n\u002F\u002F Support dual keys during rotation\nfunction getApiKey(): string {\n  \u002F\u002F Try primary first, fall back to secondary during rotation\n  return process.env.DOCUMENSO_API_KEY_PRIMARY\n    ?? process.env.DOCUMENSO_API_KEY_SECONDARY\n    ?? (() => { throw new Error(\"No Documenso API key configured\"); })();\n}\n\n\u002F\u002F Rotation procedure:\n\u002F\u002F 1. Generate new key in Documenso dashboard\n\u002F\u002F 2. Set as DOCUMENSO_API_KEY_SECONDARY, deploy\n\u002F\u002F 3. Verify secondary key works\n\u002F\u002F 4. Move secondary to PRIMARY, deploy\n\u002F\u002F 5. Revoke old key in dashboard\n```\n\n### Step 3: Webhook Secret Verification\n\n```typescript\nimport { timingSafeEqual } from \"crypto\";\n\nfunction verifyWebhookSecret(req: Request): boolean {\n  const received = req.headers[\"x-documenso-secret\"] as string;\n  const expected = process.env.DOCUMENSO_WEBHOOK_SECRET!;\n\n  if (!received || !expected) return false;\n\n  \u002F\u002F Use constant-time comparison to prevent timing attacks\n  return timingSafeEqual(\n    Buffer.from(received, \"utf8\"),\n    Buffer.from(expected, \"utf8\")\n  );\n}\n```\n\n```python\n# Python equivalent\nimport hmac, os\nfrom flask import request\n\ndef verify_webhook(req):\n    received = req.headers.get(\"X-Documenso-Secret\", \"\")\n    expected = os.environ[\"DOCUMENSO_WEBHOOK_SECRET\"]\n    return hmac.compare_digest(received, expected)\n```\n\n### Step 4: Document Access Control\n\n```typescript\n\u002F\u002F Principle of least privilege with API keys\n\u002F\u002F Personal keys: only YOUR documents\n\u002F\u002F Team keys: all documents in the team\n\n\u002F\u002F Restrict document access by checking ownership\nasync function getDocumentSecure(documentId: number, userId: string) {\n  const doc = await client.documents.getV0(documentId);\n\n  \u002F\u002F Verify the requesting user is the owner or a recipient\n  const isOwner = doc.userId === parseInt(userId);\n  const isRecipient = doc.recipients?.some(r => r.email === userEmail);\n\n  if (!isOwner && !isRecipient) {\n    throw new Error(\"Access denied: not authorized for this document\");\n  }\n\n  return doc;\n}\n```\n\n### Step 5: Signing Certificate Security (Self-Hosted)\n\nSelf-hosted Documenso requires a `.p12` signing certificate for legally valid digital signatures.\n\n```bash\n# Generate a self-signed certificate (development only)\nopenssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes\nopenssl pkcs12 -export -out signing-cert.p12 -inkey key.pem -in cert.pem\n\n# Mount into Docker container\ndocker run -v $(pwd)\u002Fsigning-cert.p12:\u002Fopt\u002Fdocumenso\u002Fcert.p12 \\\n  -e NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=\u002Fopt\u002Fdocumenso\u002Fcert.p12 \\\n  -e NEXT_PRIVATE_SIGNING_PASSPHRASE=your-passphrase \\\n  documenso\u002Fdocumenso:latest\n```\n\nFor production, use a certificate from a trusted CA (e.g., GlobalSign, DigiCert).\n\n### Step 6: Self-Hosted Production Secrets\n\n```bash\n# Generate cryptographically secure secrets\nopenssl rand -hex 32  # NEXTAUTH_SECRET\nopenssl rand -hex 32  # NEXT_PRIVATE_ENCRYPTION_KEY\nopenssl rand -hex 32  # NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY\n\n# Never reuse secrets across environments\n# Never use default values in production\n```\n\n## Security Checklist\n\n- [ ] API key stored in environment variable, never in source code\n- [ ] `.env` in `.gitignore`\n- [ ] CI secrets use masked\u002Fencrypted storage\n- [ ] Team keys rotated on employee offboarding\n- [ ] Webhook secret uses constant-time comparison\n- [ ] Self-hosted: HTTPS with valid TLS certificates\n- [ ] Self-hosted: signing certificate from trusted CA\n- [ ] Self-hosted: secrets generated with `openssl rand -hex 32`\n- [ ] No API keys or secrets in logs (sanitize before logging)\n- [ ] Key rotation procedure documented and tested\n\n## Error Handling\n\n| Security Issue | Indicator | Response |\n|---------------|-----------|----------|\n| Invalid API key | 401 errors | Rotate key immediately |\n| Webhook spoofing | Invalid secret header | Reject request, alert team |\n| Key exposed in git | GitHub secret scanning alert | Revoke key, rotate, audit access |\n| Brute force | Many 401s from same IP | Rate limit by IP at reverse proxy |\n\n## Resources\n\n- [OWASP API Security](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security\u002F)\n- [Documenso Security](https:\u002F\u002Fdocumenso.com\u002Fsecurity)\n- [Webhook Verification Docs](https:\u002F\u002Fdocs.documenso.com\u002Fdocs\u002Fdevelopers\u002Fwebhooks\u002Fverification)\n- [Self-Hosting: Signing Certificate](https:\u002F\u002Fdocs.documenso.com\u002Fdevelopers\u002Fself-hosting\u002Fsigning-certificate)\n\n## Next Steps\n\nFor production deployment, see `documenso-prod-checklist`.\n\n","# Documenso Security Basics\n\n## Overview\n\nEssential security practices for Documenso integrations: API key management, webhook verification, document access control, and self-hosted signing certificate configuration.\n\n## Prerequisites\n\n- Documenso account with API access\n- Understanding of environment variables and secret management\n- Completed `documenso-install-auth` setup\n\n## Instructions\n\n### Step 1: API Key Security\n\n```typescript\n\u002F\u002F NEVER hardcode keys\nconst BAD = new Documenso({ apiKey: \"api_abc123...\" }); \u002F\u002F Exposed in source\n\n\u002F\u002F ALWAYS use environment variables\nconst GOOD = new Documenso({ apiKey: process.env.DOCUMENSO_API_KEY! });\n```\n\n**Key management rules:**\n- Store in `.env` (never committed) or a secrets manager (Vault, AWS Secrets Manager)\n- Use team-scoped keys for team resources, personal keys for personal documents\n- Rotate keys on employee offboarding -- revoke in dashboard immediately\n- CI\u002FCD: use masked\u002Fencrypted secrets (GitHub Secrets, GitLab CI variables)\n\n```bash\n# .gitignore — always include\n.env\n.env.*\n!.env.example\n```\n\n### Step 2: Key Rotation with Zero Downtime\n\n```typescript\n\u002F\u002F Support dual keys during rotation\nfunction getApiKey(): string {\n  \u002F\u002F Try primary first, fall back to secondary during rotation\n  return process.env.DOCUMENSO_API_KEY_PRIMARY\n    ?? process.env.DOCUMENSO_API_KEY_SECONDARY\n    ?? (() => { throw new Error(\"No Documenso API key configured\"); })();\n}\n\n\u002F\u002F Rotation procedure:\n\u002F\u002F 1. Generate new key in Documenso dashboard\n\u002F\u002F 2. Set as DOCUMENSO_API_KEY_SECONDARY, deploy\n\u002F\u002F 3. Verify secondary key works\n\u002F\u002F 4. Move secondary to PRIMARY, deploy\n\u002F\u002F 5. Revoke old key in dashboard\n```\n\n### Step 3: Webhook Secret Verification\n\n```typescript\nimport { timingSafeEqual } from \"crypto\";\n\nfunction verifyWebhookSecret(req: Request): boolean {\n  const received = req.headers[\"x-documenso-secret\"] as string;\n  const expected = process.env.DOCUMENSO_WEBHOOK_SECRET!;\n\n  if (!received || !expected) return false;\n\n  \u002F\u002F Use constant-time comparison to prevent timing attacks\n  return timingSafeEqual(\n    Buffer.from(received, \"utf8\"),\n    Buffer.from(expected, \"utf8\")\n  );\n}\n```\n\n```python\n# Python equivalent\nimport hmac, os\nfrom flask import request\n\ndef verify_webhook(req):\n    received = req.headers.get(\"X-Documenso-Secret\", \"\")\n    expected = os.environ[\"DOCUMENSO_WEBHOOK_SECRET\"]\n    return hmac.compare_digest(received, expected)\n```\n\n### Step 4: Document Access Control\n\n```typescript\n\u002F\u002F Principle of least privilege with API keys\n\u002F\u002F Personal keys: only YOUR documents\n\u002F\u002F Team keys: all documents in the team\n\n\u002F\u002F Restrict document access by checking ownership\nasync function getDocumentSecure(documentId: number, userId: string) {\n  const doc = await client.documents.getV0(documentId);\n\n  \u002F\u002F Verify the requesting user is the owner or a recipient\n  const isOwner = doc.userId === parseInt(userId);\n  const isRecipient = doc.recipients?.some(r => r.email === userEmail);\n\n  if (!isOwner && !isRecipient) {\n    throw new Error(\"Access denied: not authorized for this document\");\n  }\n\n  return doc;\n}\n```\n\n### Step 5: Signing Certificate Security (Self-Hosted)\n\nSelf-hosted Documenso requires a `.p12` signing certificate for legally valid digital signatures.\n\n```bash\n# Generate a self-signed certificate (development only)\nopenssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes\nopenssl pkcs12 -export -out signing-cert.p12 -inkey key.pem -in cert.pem\n\n# Mount into Docker container\ndocker run -v $(pwd)\u002Fsigning-cert.p12:\u002Fopt\u002Fdocumenso\u002Fcert.p12 \\\n  -e NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=\u002Fopt\u002Fdocumenso\u002Fcert.p12 \\\n  -e NEXT_PRIVATE_SIGNING_PASSPHRASE=your-passphrase \\\n  documenso\u002Fdocumenso:latest\n```\n\nFor production, use a certificate from a trusted CA (e.g., GlobalSign, DigiCert).\n\n### Step 6: Self-Hosted Production Secrets\n\n```bash\n# Generate cryptographically secure secrets\nopenssl rand -hex 32  # NEXTAUTH_SECRET\nopenssl rand -hex 32  # NEXT_PRIVATE_ENCRYPTION_KEY\nopenssl rand -hex 32  # NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY\n\n# Never reuse secrets across environments\n# Never use default values in production\n```\n\n## Security Checklist\n\n- [ ] API key stored in environment variable, never in source code\n- [ ] `.env` in `.gitignore`\n- [ ] CI secrets use masked\u002Fencrypted storage\n- [ ] Team keys rotated on employee offboarding\n- [ ] Webhook secret uses constant-time comparison\n- [ ] Self-hosted: HTTPS with valid TLS certificates\n- [ ] Self-hosted: signing certificate from trusted CA\n- [ ] Self-hosted: secrets generated with `openssl rand -hex 32`\n- [ ] No API keys or secrets in logs (sanitize before logging)\n- [ ] Key rotation procedure documented and tested\n\n## Error Handling\n\n| Security Issue | Indicator | Response |\n|---------------|-----------|----------|\n| Invalid API key | 401 errors | Rotate key immediately |\n| Webhook spoofing | Invalid secret header | Reject request, alert team |\n| Key exposed in git | GitHub secret scanning alert | Revoke key, rotate, audit access |\n| Brute force | Many 401s from same IP | Rate limit by IP at reverse proxy |\n\n## Resources\n\n- [OWASP API Security](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security\u002F)\n- [Documenso Security](https:\u002F\u002Fdocumenso.com\u002Fsecurity)\n- [Webhook Verification Docs](https:\u002F\u002Fdocs.documenso.com\u002Fdocs\u002Fdevelopers\u002Fwebhooks\u002Fverification)\n- [Self-Hosting: Signing Certificate](https:\u002F\u002Fdocs.documenso.com\u002Fdevelopers\u002Fself-hosting\u002Fsigning-certificate)\n\n## Next Steps\n\nFor production deployment, see `documenso-prod-checklist`.\n\n",{"name":5,"tags":54,"author":55,"license":15,"version":56,"description":57,"allowed-tools":58,"compatible-with":59},[34,30,35,29,42],"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Implement security best practices for Documenso document signing integrations.\nUse when securing API keys, configuring webhooks securely,\nor implementing document security measures.\nTrigger with phrases like \"documenso security\", \"secure documenso\",\n\"documenso API key security\", \"documenso webhook security\".\n","Read, Write, Edit","claude-code, codex, openclaw","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Fjeremylongshore\u002Fclaude-code-plugins-plus-skills\u002Fdocumenso-security-basics",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill documenso-security-basics",{"tool":75,"command":76},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill documenso-security-basics",{"tool":78,"command":79},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill documenso-security-basics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fjeremylongshore\u002Fclaude-code-plugins-plus-skills\u002Fdocumenso-security-basics\u002FSKILL.md",true,[],[84,96,106,115,121,128],{"skillNo":85,"name":86,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":92,"publishedAt":49},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[89],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[93,94,95],"model","model hierarchy","model hierarchy skill",{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":102,"publishedAt":49},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[101],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},[103,104,105],"MCP","zoom","zoom mcp",{"skillNo":107,"name":108,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":49},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[112,113,114,104],"sdk","zoom apps sdk","apps",{"skillNo":116,"name":117,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":49},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[117],{"skillNo":122,"name":123,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":49},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[126],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},[123],{"skillNo":129,"name":130,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":49},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[130]]