Skip to main content
Solved

Bypassing User Authorization for access token

  • January 2, 2025
  • 2 replies
  • 229 views

Forum|alt.badge.img+1

We are currently working on integrating DocuSign with our MySQL database using the low-code ETL tool Integrate.io. During the integration process, we've encountered an issue related to the redirect URI.

Our primary question is whether it is possible to integrate the DocuSign API without requiring the user-authorization step to generate an access token. Specifically, we want to confirm if the integration can be achieved using only the client secret and integration key, bypassing the need for individual user authentication.

Additionally, we're wondering if there are any other authorization grants, other than JWT, that might be more suitable for this situation.

Best answer by JohnSantos

@JerseySTEM 

You need to use JWT (with a one-time consent) if you want the closest thing to a fully server-to-server integration. After that initial step, you can automatically acquire and refresh tokens without further user involvement.

JWT Grant is almost certainly your best (and only) option if your goal is to run a scheduled or automated process without prompting a user each time. You do still need to do the one-time consent step (by a DocuSign admin or the user), but after that, you can continuously generate valid tokens in the background.

DocuSign requires OAuth 2.0 for authentication and does not support a simple “client secret + integration key only” approach. For server-to-server integrations, the recommended method is the JWT grant, which still involves a one-time user/admin consent, after which tokens can be generated automatically without further user interaction. No other DocuSign OAuth grant fully bypasses the consent process.

2 replies

JohnSantos
Guru
Forum|alt.badge.img+19
  • Guru
  • 1076 replies
  • Answer
  • January 2, 2025

@JerseySTEM 

You need to use JWT (with a one-time consent) if you want the closest thing to a fully server-to-server integration. After that initial step, you can automatically acquire and refresh tokens without further user involvement.

JWT Grant is almost certainly your best (and only) option if your goal is to run a scheduled or automated process without prompting a user each time. You do still need to do the one-time consent step (by a DocuSign admin or the user), but after that, you can continuously generate valid tokens in the background.

DocuSign requires OAuth 2.0 for authentication and does not support a simple “client secret + integration key only” approach. For server-to-server integrations, the recommended method is the JWT grant, which still involves a one-time user/admin consent, after which tokens can be generated automatically without further user interaction. No other DocuSign OAuth grant fully bypasses the consent process.


Forum|alt.badge.img+6
  • Digital Collaborator
  • 42 replies
  • January 4, 2025
Hello JerseySTEM,
 
Thank you for using Docusign Community. 

@JohnSantos is correct,  JWT is our no-human-interaction options. 
Be aware that step #1 (Grant Consent) has to be done only once, then never again.  The integration can continue to work independently. 
https://developers.docusign.com/platform/auth/jwt/jwt-get-token/


 
Best regards,
 
Adrian | Docusign Developer Support