Unable to complete the JWT token exchange. Error: invalid_request. Error description: .

​@rijwanmohmmed 

For a DocuSign Demo / Developer account, your External Credential should look like this:
Authentication Protocol    OAuth 2.0
Authentication Flow Type    JWT Bearer Flow
Identity Provider URL    https://account-d.docusign.com/oauth/token
Signing Algorithm    RS256
JWT Expiration    3600 or less
Signing Certificate    Certificate created from the DocuSign RSA private key

Can you confirm?

Hi ​@rijwanmohmmed 

The error Unable to complete the JWT token exchange. Error: invalid_request. Error description: is a generic token-exchange failure, so the exact authentication flow and environment are important.

If using Docusign JWT Grant

Please verify the following:

• Use the correct token endpoint:

  • Demo: https://account-d.docusign.com/oauth/token

  • Production: https://account.docusign.com/oauth/token

• Confirm the JWT uses RS256 and contains the correct claims:

  • iss: integration key

  • sub: impersonated user ID

  • aud: the matching Docusign account-server host

  • iat and exp: valid Unix timestamps

  • scope: signature impersonation

• Confirm the RSA public key is configured on the integration key and that the JWT is signed with the matching private key.

• Confirm that the user or administrator has granted consent for the integration to impersonate the user.

• Verify that the request is sent as a form-encoded POST with:

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=YOUR_JWT

• Check that the server clock is synchronized and that the JWT has not expired.

• Confirm that the integration key and user belong to the same environment: Demo or Production.

Docusign documentation:

• JWT Grant authentication

• How to obtain an access token with JWT Grant

• Obtain and revoke consent

• JWT Grant best practices

If using Authorization Code Grant with PKCE

If this is not JWT Grant but Authorization Code Grant, an invalid_request with no additional description can indicate that the code_verifier does not match the original code_challenge.

Please verify that:

• The authorization request uses code_challenge_method=S256.

• The code_challenge is the Base64URL-encoded SHA-256 hash of the original code_verifier.

• The same, unmodified code_verifier is sent during token exchange.

• The authorization code is complete, has not expired, and has not already been used.

• The correct Demo or Production token endpoint is being used.

• For a single-page application, the configured Origin URL and Origin header are correct.

Documentation:

• Public Authorization Code Grant: obtain an access token