Go-Live classification and RSA key for an ISV app where each customer uses its own integration key (JWT Grant)
Hello,
We are developing a SaaS application in Japan that uses embedded signing (focused view) with the eSignature REST API. We are not a Docusign partner.
Our planned setup is as follows:
- Each customer has its own paid Docusign account.
- Each customer creates its own integration key in its own developer account, and later promotes it to its own production account.
- We use JWT Grant. We hold one RSA key pair (the private key is stored in a cloud key management service and never leaves it). Each customer uploads our RSA public key to its integration key ("+ Upload RSA"), and grants consent for a dedicated, non-admin sending user.
- Our application then sends envelopes from the customer's account as that user.
Our questions:
1. Classification: When the customer promotes this integration key to production, which integration classification should the customer select, "Private custom integration" or "Third-party integration key"? We understand the classification cannot be changed after review or go-live, so we would like to give our customers the correct instruction.
2. Shared public key: Is it acceptable for the same RSA public key (one key pair held by us) to be uploaded to integration keys in multiple customers' accounts? Is there any policy or recommendation against this?
3. Plan: For this setup, is a Business Pro plan (or higher) in the customer's production account sufficient for the integration key to be promoted? If the customer purchased its plan through sales rather than online, will promotion require a manual review or a different process?
Thank you for your help.
Back to Docusign.com

