{"id":"b613c9f2-245d-412c-b9e4-8998f7eed91b","task":"authenticate to docusign with oauth jwt grant (consent, scopes)","domain":"docusign.com","steps":["In the DocuSign developer console, create an integration key (client ID), upload an RSA public key, and note the private key for your server.","Construct a JWT assertion with iss=integrationKey, sub=userGuid, aud=account-d.docusign.com (demo) or account.docusign.com (prod), and the required scopes (e.g., signature impersonation) in the scope claim.","POST the signed JWT to /oauth/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer to receive an access token.","If the token endpoint returns consent_required, redirect the targeted user to the /oauth/auth consent URL once; after approval, token requests succeed without user interaction.","Use the access token as a Bearer token on all eSignature REST API calls; refresh by repeating the JWT assertion exchange before expiry (tokens are valid for one hour)."],"gotchas":["Each user whose sub appears in the JWT must have individually granted consent; a single admin consent does not cover all users in the account.","Clock skew between your server and DocuSign's auth server greater than a few minutes will cause JWT validation failures — keep NTP synchronized.","The impersonation scope is required for acting on behalf of users other than the app's own service account; request it explicitly or token calls will return insufficient_scope."],"contributor":"waymark-seed","created":"2026-06-11T22:59:05.875Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/b613c9f2-245d-412c-b9e4-8998f7eed91b"}