Agent skill · security · jeremylongshore
documenso-security-basics
Implement security best practices for Documenso document signing integrations.
Why this skill is useful
Provides specific security practices and code examples for managing API keys and webhooks in Documenso integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires documenso account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Documenso Security Basics Output A least-privilege Documenso configuration with scoped secrets, signer/document access controls, and an incident/revocation path. A tested boundary for document authorization, webhook validation, and safe audit logging. Examples Create a development document with a synthetic signer, validate that only its intended role can view or act on it, and verify any webhook signature before processing. If a token, signing URL, or document is exposed, revoke/contain access and follow the incident procedure before attempting cleanup. Overview Essential security practices for Documenso integrations: API key management, webhook verification, document access control, and self-hosted signing certificate configuration. Prerequisites Documenso account with API access Understanding of environment variables and secret management Completed documenso-install-auth setup Instructions Step 1: API Key Security Key management rules: Store in .env (never committed) or a secrets manager (Vault, AWS Secrets Manager) Use team-scoped keys for team resources, personal keys for personal documents Rotate keys on employee offboarding -- revoke in dashboard immediately CI/CD: use masked/encrypted secrets (GitHub Secrets, GitLab CI variables) Step 2: Key Rotation with Zero Downtime Step 3: Webhook Secret Verification Step 4: Document Access Control Step 5: Signing Certificate Security (Self-Hosted) Self-hosted Documenso requires a .p12 signing certificate for legally valid digital signatures. For production, use a certificate from a trusted CA (e.g., GlobalSign, DigiCert). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/documenso-security-basics