Skip to main content
Question

Docusign Web Forms HTTP 401 Upon Submission

  • December 9, 2025
  • 2 replies
  • 22 views

Forum|alt.badge.img+1

Hi,

I’m trying to use Embedded Web Forms in my React App. I’m using the following Docusign NPM Packages:

  • docusign-esign @ ^8.4.0

  • docusign-webforms @ ^2.1.0

I have created an Application at https://apps-d.docusign.com/admin/apps-and-keys, and I have requested the following OAuth Scopes, and approved these within the Browser:

const scopes = [
docusign.ApiClient.OAuth.Scope.IMPERSONATION,
docusign.ApiClient.OAuth.Scope.SIGNATURE,
docusign.ApiClient.OAuth.Scope.EXTENDED,
'webforms_instance_read',
'webforms_instance_write',
'webforms_read',
];

I use the `requestJWTUserToken()` method from the SDK to successfully authenticate using my Private Key and this returns an Access Token.

I then use the `FormInstanceManagementApi.createInstance()` method from the SDK to create a Web Form Instance, using the Access Token from the step above.

This all works, and the Web Form renders within my browser. I am able to complete all steps within the Web Form, however when I get to the “Summary” Page and click “Next” the call to `https://apps-d.docusign.com/api/proxy-us-s1/webforms/v1.1/forms/<Form ID>/actions/ESignAction_7vJJk08g` fails with a HTTP 401.

{
"errorCode": "AUTHORIZATION_INVALID_TOKEN",
"message": "The access token provided is expired, revoked or malformed."
}

I have tried:

  • Clearing Browser Cookies & Cache
  • Trying different Browsers (Firefox and Chrome)
  • Using Postman to generate the `FormUrl` and `instanceToken` then opening the combined link directly in the Browser rather than in my App to rule-out any issues with my React configuration
  • Revoking and re-authorising the OAuth scopes in Developer Centre

 

In all cases, I am able to generate the Web Form, open it, and complete it, however it fails on submission.

 

Any suggestions on what I’ve misconfigured?

 

Many thanks in advance!

2 replies

Forum|alt.badge.img+3
  • Docusign Employee
  • December 10, 2025

Hi ​@Dave Osment 

Thanks for reaching out to the Docusign Community.

This error indicates that the request failed because the access token supplied in the request header was invalid. The JWT lasts one hour. Using an expired token might be one of the causes of the error. You should also check if the user has revoked consent for the application. Please access the link below for more information and recommendations on resolving the issue.

https://developers.docusign.com/docs/esign-rest-api/esign101/error-codes/troubleshooting-common-errors/#authorization-invalid-token
 
Best regards,


Forum|alt.badge.img+1
  • Author
  • Newcomer
  • December 12, 2025

Hi Iandro,

 

Thank you for your suggestions - I have checked that both the JWT and the Web Form Instance Token are still valid, and I have revoked and re-confirmed OAUTH permission which has had no effect.

 

Any other suggestions would be most welcome.

 

Many thanks!