DocuSign OAuth 2.0 Migration Guide: JWT, Auth Code Grant & Modern Alternatives (2026)

# Generate private RSA key
openssl genrsa -out docusign_private.key 2048

# Extract public key to paste into DocuSign Admin Console
openssl rsa -in docusign_private.key -pubout -out docusign_public.key

https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://yourdomain.com/auth/callback

import jwt from "jsonwebtoken";

class DocuSignTokenManager {
  private cachedToken: string | null = null;
  private expiresAt: number = 0;

  constructor(
    private integrationKey: string,
    private userId: string,
    private privateKeyPem: string,
    private authServer: string = "account-d.docusign.com" // account.docusign.com for prod
  ) {}

  async getAccessToken(): Promise<string> {
    const now = Math.floor(Date.now() / 1000);

    // Reuse cached token if more than 5 minutes remain
    if (this.cachedToken && this.expiresAt - now > 300) {
      return this.cachedToken;
    }

    // Sign new JWT assertion
    const assertion = jwt.sign(
      {
        iss: this.integrationKey,
        sub: this.userId,
        aud: this.authServer,
        iat: now,
        exp: now + 3600,
        scope: "signature impersonation",
      },
      this.privateKeyPem,
      { algorithm: "RS256" }
    );

    // Exchange assertion with DocuSign OAuth token endpoint
    const response = await fetch(`https://${this.authServer}/oauth/token`, {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
        assertion,
      }),
    });

    if (!response.ok) {
      const errorText = await response.text();
      throw new Error(`DocuSign OAuth Failed (${response.status}): ${errorText}`);
    }

    const data = await response.json();
    this.cachedToken = data.access_token;
    this.expiresAt = now + data.expires_in;

    return this.cachedToken!;
  }
}

import time
import requests
import jwt

class DocuSignAuthService:
    def __init__(self, integration_key: str, user_id: str, private_key_pem: str, is_production: bool = False):
        self.integration_key = integration_key
        self.user_id = user_id
        self.private_key_pem = private_key_pem
        self.auth_server = "account.docusign.com" if is_production else "account-d.docusign.com"
        self._cached_token = None
        self._expires_at = 0

    def get_token(self) -> str:
        now = int(time.time())
        # Return token if valid for at least 5 more minutes
        if self._cached_token and (self._expires_at - now > 300):
            return self._cached_token

        # Mint RS256 assertion
        payload = {
            "iss": self.integration_key,
            "sub": self.user_id,
            "aud": self.auth_server,
            "iat": now,
            "exp": now + 3600,
            "scope": "signature impersonation"
        }

        assertion = jwt.encode(payload, self.private_key_pem, algorithm="RS256")

        resp = requests.post(
            f"https://{self.auth_server}/oauth/token",
            data={
                "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
                "assertion": assertion
            },
            headers={"Content-Type": "application/x-www-form-urlencoded"}
        )

        if resp.status_code != 200:
            raise RuntimeError(f"DocuSign OAuth rejected: {resp.status_code} - {resp.text}")

        data = resp.json()
        self._cached_token = data["access_token"]
        self._expires_at = now + data["expires_in"]
        return self._cached_token

// No JWTs, no RSA keys, no token caching, no expiry dance
const response = await fetch("https://signb.ee/api/v1/send", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${process.env.SIGNBEE_API_KEY}`,
  },
  body: JSON.stringify({
    markdown: "# Master Services Agreement\n\nContract terms...",
    recipient_name: "Sarah Connor",
    recipient_email: "sarah@cyberdyne.com",
  }),
});

const { document_id, signing_url } = await response.json();