How to add e-signatures
in Java

Exchange your OAuth2 client credentials for a short-lived access token using Java 11+'s built-in HttpClient — no Apache HttpComponents or OkHttp required.

import java.net.URI;
import java.net.URLEncoder;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import com.fasterxml.jackson.databind.ObjectMapper;

HttpClient client = HttpClient.newHttpClient();
ObjectMapper mapper = new ObjectMapper();

String body = "grant_type=client_credentials"
    + "&client_id="     + URLEncoder.encode(System.getenv("GETSIGNED_CLIENT_ID"),     StandardCharsets.UTF_8)
    + "&client_secret=" + URLEncoder.encode(System.getenv("GETSIGNED_CLIENT_SECRET"), StandardCharsets.UTF_8);

HttpRequest tokenReq = HttpRequest.newBuilder()
    .uri(URI.create("https://api.getsigned.app/oauth/token"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

HttpResponse<String> tokenRes = client.send(tokenReq, HttpResponse.BodyHandlers.ofString());
String token = (String) mapper.readValue(tokenRes.body(), java.util.Map.class).get("access_token");

Upload the PDF and declare signers and fields with a multipart/form-data request. Java 11 HttpClient supports multipart via a custom BodyPublisher.

import java.nio.file.*;
import java.util.*;

String boundary = "----GetSignedBoundary" + System.currentTimeMillis();
byte[] pdfBytes  = Files.readAllBytes(Path.of("nda.pdf"));

String signers = """
    [{"name":"Jamie","email":"jamie@client.io"}]""";
String fields  = """
    [{"type":"signature","page":1,"x":420,"y":580}]""";

// Build multipart body
byte[] CRLF = "\r\n".getBytes();
var parts = new ArrayList<byte[]>();
// -- document part
parts.add(("--" + boundary + "\r\n").getBytes());
parts.add("Content-Disposition: form-data; name=\"document\"; filename=\"nda.pdf\"\r\n".getBytes());
parts.add("Content-Type: application/pdf\r\n\r\n".getBytes());
parts.add(pdfBytes); parts.add(CRLF);
// -- signers & fields as text parts (omitted for brevity — same pattern)
parts.add(("--" + boundary + "--\r\n").getBytes());

HttpRequest envReq = HttpRequest.newBuilder()
    .uri(URI.create("https://api.getsigned.app/v1/envelopes"))
    .header("Authorization", "Bearer " + token)
    .header("Content-Type", "multipart/form-data; boundary=" + boundary)
    .POST(HttpRequest.BodyPublishers.ofByteArrays(parts))
    .build();

HttpResponse<String> envRes = client.send(envReq, HttpResponse.BodyHandlers.ofString());
String envelopeId = (String) mapper.readValue(envRes.body(), Map.class).get("id");

Sending generates a tokenized, single-use link per signer and emails it. Signers verify identity with email/SMS OTP.

HttpRequest sendReq = HttpRequest.newBuilder()
    .uri(URI.create("https://api.getsigned.app/v1/envelopes/" + envelopeId + "/send"))
    .header("Authorization", "Bearer " + token)
    .POST(HttpRequest.BodyPublishers.noBody())
    .build();

client.send(sendReq, HttpResponse.BodyHandlers.discarding());

When the last signer finishes, GetSigned POSTs envelope.completed to your endpoint. Verify the HMAC-SHA256 signature over the raw body before trusting it. Spring Boot example below.

// Spring Boot webhook controller
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.core.type.TypeReference;

@RestController
public class WebhookController {

    private static final byte[] SECRET =
        System.getenv("GETSIGNED_WEBHOOK_SECRET").getBytes(StandardCharsets.UTF_8);
    private final ObjectMapper mapper = new ObjectMapper();

    @PostMapping("/webhooks/getsigned")
    public ResponseEntity<Void> handleWebhook(
            @RequestBody byte[] raw,   // raw bytes, before JSON parsing
            @RequestHeader("X-GetSigned-Signature") String sig) throws Exception {

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(SECRET, "HmacSHA256"));
        StringBuilder hex = new StringBuilder();
        for (byte b : mac.doFinal(raw)) hex.append(String.format("%02x", b));
        // MessageDigest.isEqual is constant-time
        if (!MessageDigest.isEqual(
                hex.toString().getBytes(StandardCharsets.UTF_8),
                sig.getBytes(StandardCharsets.UTF_8))) {
            return ResponseEntity.status(401).build();
        }

        Map<String, Object> payload = mapper.readValue(raw, new TypeReference<>() {});
        if ("envelope.completed".equals(payload.get("event"))) {
            String envelopeId = (String) payload.get("envelope_id");
            // GET /v1/envelopes/{envelopeId}/document -> sealed PDF
            // Persist, notify counterparties, update your database, etc.
        }
        return ResponseEntity.ok().build();
    }
}