Bot Protection on Signup, Editor Preview Fixes & Sign API Hardening

This week we added CAPTCHA protection to self-serve signup, fixed two editor-preview issues so what you place is what gets signed, and hardened the Sign API with more accurate error responses and more reliable webhook delivery.

Security

• Bot Protection on Signup. Self-serve account creation at /signup is now protected by Cloudflare Turnstile, bringing it to parity with our promotional trial flow. Verification happens server-side before any account or organization is created, blocking scripted signups without adding friction for real users.

Propper Sign Enhancements

• Accurate Prepopulated-Text Preview. Prepopulated text fields now render in the same position in the template editor, the signing view, and the final flattened PDF. Senders who align field boxes against the previewed text will see the text land exactly where they expect it once the document is signed — eliminating a subtle shift between preview and output.
• Consistent Radio Button Resizing. Resizing a radio button by dragging its handle now updates the actual circle size and keeps every option in the group visually consistent, so radio groups stay uniform across the editor and the signer's view.

Sign API

• Richer Template Detail Responses. GET /v1/sign/templates/:id now returns the template's fields[] and documents[] directly, so integrators can audit an imported template and re-issue an import without a second round-trip through the export endpoint.
• Clearer Error Codes. Sending to a missing agreement now returns a 404 instead of a 500, and requests with a malformed (non-UUID) ID return a 400 instead of a 500. API clients get meaningful, actionable errors for client-side mistakes.
• Helpful Document-Conversion Errors. When a non-PDF upload (DOCX, XLSX, PPTX) can't be converted — for example, a password-protected or unsupported file — the API now returns a 422 you can act on, instead of an opaque 500.
• More Reliable Webhook Delivery. The agreement.sent webhook event is now emitted even when a recipient's email address is malformed, so subscribers no longer miss send events because of a bad email value on the recipient record.

See the latest improvements in action. Book a demo to see Propper Sign, or start your free trial to get started today.