Dropbox Sign for integrators: the HelloSign rebrand, then a breach that rotated their keys

Dropbox acquired HelloSign in 2019 and, in October 2022, rebranded it to Dropbox Sign — the HelloSign API became the Dropbox Sign API. Dropbox told developers the rebrand itself was low-impact: existing integrations would keep working with 'HelloSign' simply replaced by 'Dropbox Sign,' and credentials were unchanged. Companion products were renamed too (HelloFax to Dropbox Fax, HelloWorks to Dropbox Forms).

The more serious consequence for integrators came later. In the April–May 2024 Dropbox Sign security incident, an attacker reached the Dropbox Sign customer database and exposed authentication material including API keys, OAuth tokens, and MFA data. In response Dropbox reset passwords, logged users out, and rotated API keys and OAuth tokens. (The breach as a security event is covered by the existing 2024-dropbox-sign-breach entry; the developer angle is distinct.) For any application that had embedded Dropbox Sign signing into its own product, that rotation was a forced break: previously working API keys and tokens stopped working, and developers had to obtain and deploy new credentials and re-authorize OAuth connections to restore their e-signature flows.