Authentication

We are migrating an existing DocuSign SOAP integration from legacy authentication to App Password authentication and need clarification on one specific scenario.Our current SOAP authentication flow is:1. The user enters their DocuSign credential in our application.2. We authenticate using `credential.asmx`.3. We call `GetEncryptedPassword()` on `accountmanagement.asmx`.4. We store the DocuSign-issued encrypted password returned by `GetEncryptedPassword()`.5. Subsequent SOAP calls (`api.asmx`) authenticate using the `[IntegratorKey]email` username format and that encrypted password through WS-Security / `X-DocuSign-Authentication`.We have tested replacing the user's regular DocuSign password with an **App Password**. The initial authentication and `GetEncryptedPassword()` call succeed.We need confirmation on the following two questions:**1. If `GetEncryptedPassword()` is called after authenticating with an App Password, are subsequent SOAP API calls using the returned encrypted password

JWT GrantI am new to Docusing and was going through the documentation. I stumbled upon the Authorization Grant of the Platform 101 docs, and read the above excerpt. Can anyone clarify what does this mean If you use a single login for all users in your integration, you should use JWT Grant.  Using single login for all of the integration users mean what? Does that all follow the same login/signup method or the same credentials?

Hi ​@TCarpenter   ​@KimmyK @JohnSantos ,I have been facing an issue where there are two connectors created by me.For one the environment columns is Production and the other as DevelopmentHowever, I am unable to differentiate when to use https://account.docusign.com/oauth/auth and when to use https://account-d.docusign.com/oauth/authThe same request for a connector in Production works with account-d but with https://account.docusign.com/oauth/auth It gives an error“Something went wrongThe redirect URI is not registered properly with Docusign”But the same redirect uri works with account-d and same clientId, scope, redirectUrl combinationAlso, I have been facing another issue where getting a response errorcode: 400 BAD_REQUEST, message: <400,{"error":"invalid_grant","error_description":"unauthorized_client"}Although this connector is also in the Environment “Production” with the same configuration as the earlier Production Connector mentioned above.Thanks for the help.

Hi everyone,After completing the Go-Live process for our integration, I'm unable to complete JWT consent because our production account has zero registered Redirect URIs, and any attempt to add one fails.Setup:Integration Key created and verified on a Developer account, then promoted to Production via Go-Live RSA keypair generated successfully on the production app (visible under Apps and Keys → App Details) Authentication Method currently shows as "Authorization Code Grant" with zero Redirect URIs registeredThe problem:Going to Apps and Keys → [App] → Edit → Add URI → entering a valid HTTPS URL → Save consistently returns:"This integration key could not be updated. Please try again in a moment."Tried: multiple browsers, incognito mode, multiple URLs, retrying over several days. Same error every time.What I found in the docs:DocuSign's own "After Go-Live" guide states Redirect URIs should be configurable on the production account ("OAuth Management Account") directly. It also mentions

Hi everyone,I'm trying to connect to the DocuSign hosted MCP server (mcp-d.docusign.com/mcp) from an MCP client that follows the standard OAuth discovery flow, and I'm seeing what looks like an RFC 8414 deviation that I'd like to confirm before assuming it's an issue.The flow my client is doing is: Fetch https://mcp-d.docusign.com/.well-known/oauth-protected-resource. Returns 200 JSON, lists https://account-d.docusign.com as the authorization server. Per RFC 8414, fetch https://account-d.docusign.com/.well-known/oauth-authorization-server for the AS metadata. This is where I'd expect a JSON metadata document.What I see at step 2: $ curl -sSL -i https://account-d.docusign.com/.well-known/oauth-authorization-server HTTP/2 200 content-type: text/html; charset=utf-8 <!DOCTYPE html> <html lang="en" class="account-server"> ... 200 OK with text/htmlwhich the client then tries to parse as JSON and fails with: Unexpected token '<', "<!DOCTYPE "... is not valid JSONSame respons

It looks like the new SP cert has a different key from the 2026’s. - The pub keys(modulus) are different.2028 Docusign SSO Self-Signed CertificateOur IDP (Oracle IDCS) doesn’t allow to import multiple signing certs for an SP. It would have been transparent if the cert was renewed with the same key but it doesn’t seem the case. I’m thinking that I might as well tell the business team that we need to react after DocuSign has started using the 2028 cert,  but it’d be great if I’ve missed something and anyone can suggest a way to make the transition without an interruption.

Every time I try to log in at: https://support.docusign.com/s/contactSupport?language=en_US, I end up encountering the same error. How can I fix this?  

Hi there,We have an application configured with Public Authorization Code Grant using PKCE and so far the development integration is working fine. However, once the integration key was promoted to production and the configuration options for the key were set up (redirect uris and cors origin urls), we see the following error on the browser console when doing the “/oauth/token” call:Access to XMLHttpRequest at 'https://account.docusign.com/oauth/token' from origin 'https://<my_app_origin> has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.The call itself returns a 400 error with an empty response.The setup of our production Integration key is exactly the same as the key in the development environment, with one exception: in the Docusign production account we don’t see the option “Allow CORS for OAuth calls”.We have tested that when using the Docusign development account:If we have enabled CORS at the account level, then th

Hi everyone,I would like to report the following issue encountered in developers.docusign.com. Issue Description: Log in to DocuSign Demo Navigate to My Apps & Keys web page That page loads but remains completely blank (no content displayed).  After this occurs: Log out Click on login again. The login form does not appear, and the system automatically logs the user in without re-entering email address and password. Could you please investigate this issue and advise on how it can be resolved?Thanks! 

Calling Login with https://www.docusign.net/api/3.0/credential.asmx fails with "One or both of Username and Password are invalid."  The Login call is made by using “[IntegratorKey]Username” as the username.This just started recently.  I was only made aware of it today, so it could have started today.  All my customers are down. Is it possible that the API has changed and I never received any emails? We got our Integrators Key in 2013 and have not made any changes to this code in quite a while.

Not getting consent page for Authorization Code Grant sample, trying with console sample java application. getting com.docusign.click.client.ApiException: Error while requesting server, received a non successful HTTP code 400 with response Body: '{"error":"consent_required"}'

I used the Application integration key as the userId and called the ApiClient#requestJWTUserToken method. The returned tokenType was Application. What is the function of this token? Is there any documentation to explain? 

I am having no issues with the development environment; however, in production when I call the apiClient.requestJWTUserToken I’m getting back an error message.  “java.net.UnknownHostException: https”CODE    OAuthToken getToken(String apiClientUrl, String oAuthPath,             String clientId, String userId,             ArrayList<String> scopes, String keyValue) throws IllegalArgumentException, ApiException, IOException {        ApiClient apiClient =this.getApiClient(apiClientUrl, oAuthPath);        return apiClient.requestJWTUserToken(clientId, userId, scopes, keyValue.getBytes(), 3600);    }In dev the apiClient is using apiClientUrl = https://demo.docusign.net/restapithe oAuthPath value is https://account-d.docusign.com In production the apiClient is using apiClientUrl=https://www.docusign.net/restapi/v2.1the oAuthPath value is https://account.docusign.comI have verified the clientid, userid, scopes, and rsaPrivateKey values are correct.I am able to ping account.docusign.com an

Hi there,I’m getting the following error when requesting an access token from the authorization code previously generated by Docusign:{ "error": "invalid_grant"}I’ve followed all steps in https://developers.docusign.com/platform/auth/public-authcode-get-token/. I can easily get an authorization code, but when using it to request an access token I get above error. This is the request I do:POST in https://account-d.docusign.com/oauth/token with:code=<code returned as query param in the redirect_uri>grant_type=authorization_codeclient_id=<my integration key in development environment>code_verifier=<my original random string used to calculate the code challenge>I’ve made sure that the code was generated less than 2 minutes before asking for the access token.What am I missing?

I want to create a PKS/P12 certificate file from the RSA key pair for JWT.  Have tried open SSL command openssl.exe pkcs12 -export -out docusign.pfx -inkey docusign.key -in docusign.crtWith the inputs as the Private and Public key contents, but getting ‘unable to load certificates’  

I am currently integrating DocuSign with Oracle Integration (OIC). At present, I am using the following REST API to generate a bearer token:<BASE_URL>/oauth/token?grant_type=refresh_token&client_id=[client_id]&client_secret=[client_secret]&refresh_token=[refresh_token] This works fine as long as my refresh token is valid. However, when the refresh token itself expires, I currently use Postman to manually log in to my DocuSign account, provide consent, and generate a new refresh token.This approach is not ideal since it introduces manual intervention and breaks the automation.My Questions: What is the best way to avoid this manual Postman step? Is there a way to fully automate the token generation process in Oracle Integration so that I don’t have to worry about refresh token expiry? Should I switch to the JWT Grant flow for this type of server-to-server integration? Any guidance on the recommended approach would be greatly appreciated.Thanks in advance! 

Hello,         I am developing an integration from Workday to DocuSign to pull the completed documents into Workday. I am getting following error when trying to authenticate to the endpoint - https://account-d.docusign.com/oauth/token to get the access tokenError code : badrequestResponse :{"error":"invalid_grant","error_description":"unsupported_grant_type"}I have the following Grant type which works fine in Postman. In addition to grant type, assertion key is generated which is passed along with grant type in Workdayassertion=@{props['jwt.assertion']}&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearerPostman: 

I was using  https://account-d.docusign.com/oauth/token earlier and it was working fine. But now it stopped working. Getting the error  {   "error": "invalid_grant",   "error_description": "unauthorized_client" } . Can you please check and letm e know what could be the issue ?   

Hello,can someone help me to solve my Authentication problem. This is my code:// 1) Copia qui la tua Integration Key da Apps & Keysconst string IntegrationKey = "TUO-CLIENT-ID-GUID";// 2) Copia qui il tuo User ID (GUID) da My Account Informationconst string UserId = "TUO-USER-ID-GUID";// 3) Il PEM privato che hai scaricato da Service Integrationconst string PrivateKeyPath = "docusign_private_key.pem";// 4) L’host OAuth per democonst string OAuthHost = "account-d.docusign.com";// 5) L’URL base delle REST APIconst string BasePath = "https://demo.docusign.net/restapi";            var apiClient = new ApiClient(BasePath);            apiClient.SetOAuthBasePath(OAuthHost);            //byte[] privateKeyBytes = await File.ReadAllBytesAsync(PrivateKeyPath);            byte[] privateKeyBytes = Encoding.UTF8.GetBytes(privateKeyPem);//            var scopes = new[] { OAuth.ScopeSignature, OAuth.ScopeImpersonation };            OAuth.OAuthToken tokenInfo = apiClient.RequestJWTUserToken(       

Docusign account URL is account-specificAccording to https://developers.docusign.com/platform/api-endpoint-base-paths/, the {server} value (which determines the base URL for several Docusign APIs) is specific to a Docusign account:The Account Base URI section of the Apps and Keys page. This is confirmed by the structure of the /oauth/userinfo response, where the base URL can vary per account. For example:{ "sub": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "name": "First Last", "given_name": "First", "family_name": "Last", "created": "2015-08-13T22:03:03.45", "email": "first.last@example.com", "accounts": [ { "account_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "is_default": false, "account_name": "Example Europe Ltd", "base_uri": "https://eu.docusign.net" // Account 1 base URL }, { "account_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "is_default": true, "account_name": "Example Corporation", "base_uri": "https://na3.docusign.net"

Hi!I’m trying to make API calls according to this how-to articlehttps://developers.docusign.com/platform/auth/authcode/confidential-authcode-get-token/But I’m stuck on “Step 3. Get your user's base URI” - the https://account-d.docusign.com/oauth/userinfo url always response with:{ "error": "internal_server_error", "reference_id": "d63dceae-72c6-4d27-9218-3b0fd58b2c30"}Authorization header is added as described in the docs -Bearer somelongCode......ProvidedIDK why it’s happening because I’m able to get Docusign access token from step 2 - that’s means that credentials set properly. So what I’m doing wrong?Thanks!

Hello,I am trying to create a module in Make.com that checks if an envelope has been completed. This works for a while, but eventually, I receive an error message. I have a business plan with DocuSign. I have tried several solutions in both DocuSign and Make.com to resolve the issue, but so far without success.I believe the access token might only be valid for a limited time, and I’m looking for a way to either extend the access token’s validity or use a refresh token so that the system doesn’t keep failing as it does now.Has anyone encountered this issue and can offer guidance on how to solve it?Thank you in advance for your help!

Hello, While doing user testing for a client I came across a bug on the docusign platform, specifically in the Firefox browser when the 1Password extension is enabled. The password manager seems to be blocking users from fully completing their account set up with Docusign.session transaction ID b055adb1-64a6-4592-95f6-868a8f9b8d8f and the steps to reproduce this error.Steps in Firefox browser (regular or private browsing, with browser cache fully cleared): Docusign account activation by following the generated link in email inbox Set password for Docusign Account → when the login button is clicked, 1pass redirects the user to the Application error message rather than the successful Docusign login page. This process works in Chrome with 1password extension installedAny advice on how to get around this bug (without disabling the extension) would be greatly appreciated.

An Ruby on Rails application that I support is failing to send an envelope after the login/consent-grant step in the flow diagram.  I receive a response to my callback URL with a ‘code’ parameter set:https://elided-host.edu/auth/docusign/callback?code=eyJ0eXAiOiJNVCIsImFsZyI6IlJTMjU2Iiwia2lkIjoiOGFlYzFjZjQtYmE4NS00MDM5LWE1MmItYzVhODAxMjA3N2EyIn0.AQoAAAABAAYABwCAQhCGVSDdSAgAgM6WzVUg3UgCAD4nwjoJTdpMt_Th1QcGWaMVAAIAAAAYAAEAAAAFAAAADQAkAAAAZmQxZjg5YjItNjZkNi00MGRlLWFhYzctNGFhMTgzNzBlOTY5IgAkAAAAZmQxZjg5YjItNjZkNi00MGRlLWFhYzctNGFhMTgzNzBlOTY5MACAQhCGVSDdSBIAAgAAAAsAAABpbnRlcmFjdGl2ZQcAAABtYW5hZ2Vk.EIkNnGHh1iLCYF1i5JXeyfzU26B7Fx5bJao7X1_3WSJ-N56AoFAy8JA3MLbEWjWtesbXWXplU5HkIN9TyGWYqdwplswU6ai2F5pWnHy1ntHXJr-p2OFGSb7UApcMU4l2Bd-hx3TITt4zgz-YpEfJ6aZT1xoFrkhNFsrwyjpS7LbmGXLxbIKiv61rVi-09l1kem0-V8CufYuaQusnOKWIwlSCSpLXttRumLR4MUGLdTJ5AHEO5LXuKejdojD-M-P9iiTP8VRjnVSp50zi31vLeK6ghyT_ZQEeTs7aqoXIT8afi945JEExuLsIBURdQkIoQLqU0N_jftccaQlGm-YgzA&state=3066440d77f347fa1c1096f597dee488c55609163cc571

Hello I am trying to make a soap call through postman but I get an error that my username or password is incorrect. For username I use the email I have on Docusign and for the password the app password I created from the settings. Is this combination correct?XML body <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.docusign.net/API/3.0">   <soapenv:Header>      <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">         <wsse:UsernameToken>            <wsse:Username>myEmail</wsse:Username>            <wsse:Password>myPassword</wsse:Password>         </wsse:UsernameToken>      </wsse:Security>   </soapenv:Header>   <soapenv:Body>      <ds:RequestEnvelope>         <ds:EnvelopeID>MyEnvelopeId</ds:EnvelopeID>      </ds:RequestEnvelope>   </soapenv:Body></