Respond to HelloSign callback (or webhook) from within a Rails application - https://www.hellosign.com/api/eventsAndCallbacksWalkthrough

hello_sign_webhooks_controller.rb

# app/controllers/hello_sign_webhooks_controller.rb
require 'openssl' unless defined?(OpenSSL)

class HelloSignWebhooksController < ApplicationController
  class InvalidSignature < StandardError; end

  before_action :parse_params
  before_action :check_event_hash!

  def create
    # TODO: implement your logic with what you received in `params[:event]`
    render text: 'Hello API Event Received'
  end

  private

  def check_event_hash!
    message = "#{params[:event][:event_time]}#{params[:event][:event_type]}"
    expected_hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, ENV['HELLOSIGN_API_KEY'], message)
    unless ActiveSupport::SecurityUtils.secure_compare(params[:event][:event_hash], expected_hash)
      fail InvalidSignature
    end
  end

  def parse_params
    params.merge! JSON.parse(params[:json])
    params.delete :json
  end
end

routes.rb

# config/routes.rb
Rails.application.routes.draw do
  # [...]
  resource :hello_sign_webhooks, only: [ :create ]
end