Skip to navigation
Platform 101

Authenticate

View as Markdown

New to Docusign authentication? Get started quickly and easily using our Quickstart tool.

We’re currently running a beta for the Docusign Developer AI Assistant for VS Code, an AI-powered assistant to help developers generate tokens, orchestrate APIs, configure brands, and resolve integration issues faster. Install the extension from the Visual Studio Marketplace.

Docusign uses OAuth 2.0 to secure your API requests. Using OAuth, your app requests access and performs actions, such as requesting a signature, on behalf of one of your users.

Docusign provides four scenarios for implementing OAuth:

A fourth OAuth flow, OAuth for Docusign Connect, is for apps that receive Docusign Connect event notification messages. It enables you to authenticate that the Connect notification messages your app receives are from Docusign. Unlike the three grants listed above, it does not grant you an access token for making API calls to the Docusign platform.

How you implement OAuth will depend on your app’s needs. Determine the right OAuth type for your app with this decision tree.

Image showing a decision tree that recommends different types of Docusign OAuth, depending on your

  • Both the Confidential Authorization Code Grant and Public Authorization Code Grant require that the user be present when your session starts, but are simpler to implement than JWT Grant and provide a refresh token that you can use to remain authenticated.

    Both of these grants provide equivalent levels of security, but the Confidential Authorization Code Grant requires a secret key and the Public Authorization Code Grant does not.

  • The JWT Grant does not require that your users are present at the start of a session. If you use a single login for all users in your app or manage large numbers of users, you should use the JWT Grant.

Regardless of the way you authenticate, the access token that you receive is the same. If you include this access token in an API request, your request is authenticated and access to the API is granted.

Note: When you create a new integration, we recommend that you begin working from a pre-provisioned app that already implements any supported OAuth scenario. See Build a Docusign integration for details.

Walkthrough video You can also see a video overview of authentication at Docusign below:

Authentication scopes

Each time your app authenticates, it must request one or more scopes. A scope is a set of permissions for an API that the app needs to do its work. Each scope is typically specific to a Docusign API. For example, you must request the signature scope to perform most operations on the REST eSignature API.

To see the full list of all supported scopes, see Authentication scopes.

OAuth for Connect

OAuth for Connect is an OAuth flow but, unlike the three flows above, it does not grant your app an access token for making API calls. Instead, it can support your existing OAuth security requirements for Docusign Connect. See OAuth for Docusign Connect for details.

Next steps