Dropbox Sign vs PandaDoc

Dropbox Sign

A public OpenAPI 3.0.3 spec, llms.txt, six official SDKs and a free test mode let an agent build the whole flow before paying. Production sends need a paid plan from $900 a year, the API key has full account access, and no idempotency keys were found in the reviewed documentation.

PandaDoc

The public OpenAPI spec lists 133 operations and reached version 8.21.0 on 2 October 2026, and the hosted MCP server, with OAuth and dynamic client registration, is open to every plan including Free. The status page records three incidents affecting document creation, sending or the API between 15 July and 6 September 2026, and writes have no idempotency keys.

Dropbox Sign

1. Send test_mode=true while building. Test requests are free, watermarked and not legally binding, and are limited to 10 requests a minute
2. Don't blind-retry a send after a timeout. No idempotency key exists, so list requests by metadata or title first to check whether it was created
3. Authenticate with HTTP Basic, the API key as username and an empty password. Keep the key out of URLs, although the docs show that form
4. Answer every webhook with HTTP 200 and the body Hello API Event Received, and verify event_hash. Ten consecutive failures clear the callback URL
5. Treat a 200 from cancel as queued only. Confirmation arrives later as a signature_request_canceled event

PandaDoc

1. Wait for document.draft before sending. Creation is asynchronous and a new document stays in document.uploaded for a few seconds
2. Match the region. Accounts on app.pandadoc.eu use api.pandadoc.eu and mcp.pandadoc.eu, and the global hosts reject them
3. Check for an existing document before retrying a create. There's no idempotency key and each production create uses a usage credit
4. Retry 409 after a pause and back off on 429. A sandbox key allows 10 requests a minute per endpoint
5. Don't rely on webhooks alone. Failed deliveries aren't retried, so poll the status endpoint as a fallback