Skip to navigation
How-to guidesUse multi-factor recipient (signer) authentication

How to require access code authentication for a recipient

View as Markdown

This topic demonstrates how to request a signature by email while also using access code authentication.

Note: Account-wide Authentication policy settings can be configured in the Security Settings section in eSignature Admin. See the NDSE Security Settings guide for details.

Run this code example from our Quickstart or launcher projects: Bash, C#, Java, Node.js, PHP, PowerShell, Python, or Ruby.

Required data

Running the code in this how-to requires this data:

Data elementDescription
{ACCESS_CODE}A string, 50 characters or less, that you provide to your recipient for their use in authentication. This string must not contain the symbols <, >, &, and #.
{API_ACCOUNT_ID}A GUID value that identifies your account. This value is automatically generated by Docusign for any account you create. Copy the value from the API Account ID field on the Apps and Keys page.
{BASE_PATH}A string value that forms the root of the URL required to make API calls. The base path value in the example code is set to target the developer environment at
https://<domain>/restapi
Where <domain> is demo.docusign.net for the developer environment and is the result of the GetUserInfo call in production.
{RECIPIENT_ID}A unique string value that you assign to identify each recipient. This value assigns tabs on a per-recipient basis.
{SIGNER_EMAIL}A string value for the email address where the signer will receive a notification of the signing request.
{SIGNER_NAME}A string value for the full name of the signer.

Step 1. Obtain your OAuth token

To make the API call shown in this how-to, you need a valid OAuth access token. Docusign supports access tokens for three different recommended OAuth grant types: Public Authorization Code Grant, Confidential Authorization Code Grant, and JSON Web Token (JWT) Grant. Choose the OAuth grant type appropriate for your scenario.

See Confidential Authorization Code Grant for guidance on your options to get an Confidential Authorization Code Grant OAuth token.

Three icons that represent the three methods a user can use to obtain an OAuth token: JSON Web Token (JWT), Public Authorization Code Grant (ACG), and Confidential Authorization Code grant

Step 2. Construct your API headers

After you have a valid OAuth access token, you are ready to construct the API headers that you will pass to the API call. Construct your headers like this, but make sure to substitute your valid OAuth access token for {ACCESS_TOKEN}.

declare -a Headers=('--header' "Authorization: Bearer ${ACCESS_TOKEN}" \
					'--header' "Accept: application/json" \
					'--header' "Content-Type: application/json")

Step 3. Construct the request body

Next, create the request body. To create an envelope using the eSignature API, you need to construct an envelope body in JSON format. Replace {RECIPIENT_ID}, {SIGNER_NAME}, {SIGNER_EMAIL}, and {ACCESS_CODE} with your recipient’s data in the JSON request body.

Note: When specifying upper- and lowercase letters in your {ACCESS_CODE}, the code is not case-sensitive. Access codes have specific security limits such as allowed access to the email link and time limitations.

Note: The sample code provided uses fixed positioning for the signHere tab. If your Docusign account has Document Visibility enabled (via Sending Settings in eSignature Admin), and you have not placed a tab for each signer, you will receive this API error: “Freeform signing is not allowed for your account because it conflicts with other settings, please place fields for each signer.”

Note: Optionally, you can set an additional recipient authentication method when utilizing Access Code authentication. Fill in the idCheckConfigurationName property with the name of the additional method (e.g.: SMS Auth $ or Phone Auth $).

printf \
'{
    "documents": [
        {
            "documentBase64": "' >> $request_data
            cat $doc_base64 >> $request_data
            printf '",
            "name": "Lorem Ipsum",
            "fileExtension": "pdf",
            "documentId": "1"
        }
    ],
	"emailBlurb": "Sample text for email body",
	"emailSubject": "Please Sign",
	"envelopeIdStamping": "true",
	"recipients": {
	"signers": [{
		"name": "'"${SIGNER_NAME}"'",
		"email": "'"${SIGNER_EMAIL}"'",
		"roleName": "",
		"note": "",
		"routingOrder": 1,
		"status": "created",
				"tabs": {
				"signHereTabs": [{
					"documentId": "1",
					"name": "SignHereTab",
					"pageNumber": "1",
					"recipientId": "1",
					"tabLabel": "SignHereTab",
					"xPosition": "200",
					"yPosition": "160"
				}]
			},
		"templateAccessCodeRequired": null,
		"deliveryMethod": "email",
		"recipientId": "1",
		"accessCode": "'"${ACCESS_CODE}"'",
		"smsAuthentication": null,
		"idCheckConfigurationName": "",
		"requireIdLookup": false
	}]
	},
	"status": "Sent"
}
' >> $request_data

Step 4. Call the eSignature REST API

Now that you have constructed your API headers and request body, you can send the envelope with the Envelopes:create method. Here’s how you make the call, but make sure to substitute your API account ID for {ACCOUNT_ID}.

View the source code for this how-to on GitHub: Bash, C#, Java, Node.js, PHP, PowerShell, Python, or Ruby.

curl --request POST "https://demo.docusign.net/restapi/v2.1/accounts/${account_id}/envelopes" \
     "${Headers[@]}" \
     --data-binary @${request_data} \
     --output ${response}

Expected response

If you run this code example from our Quickstart or launcher projects, you should see a JSON response similar to the code shown.

In addition, the signer receives an email containing a signing link. After they authenticate with the correct access code, they can open and electronically sign a document using the Docusign mobile app or the Docusign website. After signing is complete, the recipient receives a carbon copy (CC) of the email that includes all of the completed and signed documents.

Sample response
{
  "envelopeId": "94501579-xxxx-xxxx-xxxx-52942ac803f8",
  "uri": "/envelopes/94501579-xxxx-xxxx-xxxx-52942ac803f8",
  "statusDateTime": "2020-08-10T18:00:47.5770000Z",
  "status": "sent"
}

Next steps