Authentication | Docusign

Before your application can make calls to the Rooms API, it must authenticate and obtain an access token. You must submit this access token, which proves your app’s identity and authorization, with each request.

You can use any supported OAuth2 authentication workflows to obtain an access token and make calls to the Rooms API: Authorization Code Grant, Implicit Grant, or JSON Web Token (JWT) Grant. Service integrations may use Authorization Code Grant or JWT grant, while mobile apps may use Implicit Grant. See platform authentication for an overview of these grants and how to choose which grant to use for your app.

Prerequisites

Before you can use the Docusign Rooms API, you need the following:

A Docusign eSignature developer account and a Docusign Rooms account.
- Create an eSignature developer account.
- Create a Rooms developer account.
An integration key that identifies your app.
A defined redirect URI for your integration key. This is the URL the user’s internet browser will be sent to the redirect URI after authentication is complete.
You must also have configured your app correctly for the OAuth type you want to use. For details, see configure your app.

Required scopes

The only difference between authenticating with the Rooms API and the eSignature API is that when you request an access token for your OAuth2 scenario, you must request a special Rooms API scope during the authentication process. You can combine Rooms scopes with eSignature API scopes.

You can choose from the following Rooms scopes:

Scope	Description
`dtr.rooms.read`	Read rooms data.
`dtr.rooms.write`	Update the data of a room.
`dtr.documents.read`	Read documents from Docusign Rooms.
`dtr.documents.write`	Write documents to Docusign Rooms.
`dtr.profile.read`	Read profile data for accounts or signers associated with your company.
`dtr.profile.write`	Write profile data to accounts or signers associated with your company.
`dtr.company.read`	Read information from all rooms and profiles associated with your company.
`dtr.company.write`	Write information to all rooms and profiles associated with your company.
`room_forms`	Use endpoints related to the forms feature.
`signature`	The eSignature API `signature` scope is required to call the GetESignPermissionProfiles method.

Using Authorization Code Grant, you request scopes when you make the authorization code request.
Using Implicit Grant, you request scopes when you make the access token request.
Using JWT Grant, you request scopes in the body of the JWT token.

Next steps:

See authentication in the Platform 101 documentation for an overview of each OAuth grant and how to choose which grant to use for your app.
Learn how to implement each authentication flow by viewing these guides:
- How to obtain an access token with Confidential Authorization Code Grant.
- How to obtain an access token with Implicit Grant.
- How to obtain an access token with JWT Grant.