DocuSign JWT Grant

Connect DocuSign with JWT Grant when a workflow should keep working without anyone signing in again. Sim signs a short-lived assertion with your app's RSA private key, exchanges it for an access token that acts as one DocuSign user, and repeats that every hour. DocuSign issues no refresh token for JWT Grant, so nothing expires as long as the key and the user's consent stay in place.

Every envelope, template, and download runs as the impersonated user, with that user's DocuSign permissions. Use a dedicated user when you can.

Prerequisites

• A DocuSign account in the environment you want: a free developer account (demo) or a production account
• Admin access to Apps and Keys in that account, to create the integration key

Create the integration key

1. 1

   In DocuSign, open the Apps and Keys page and add an app. Give it a name (e.g. Sim workflows) and click ADD

2. 2

   Copy the integration key DocuSign assigns (a GUID)

3. 3

   Under RSA key pair, click GENERATE RSA. Copy the private key before you close the dialog, including its BEGIN and END lines. DocuSign masks it afterwards and can't show it again

4. 4

   Under Redirect URI, click ADD URI and enter the address you open Sim at (for example https://sim.ai). DocuSign requires a redirect URI for the consent step; Sim never uses what it receives there

5. 5

   Leave User Application set to Yes (the default) and click SAVE

Find the user ID

The Apps and Keys page shows your User ID and API Account ID, both GUIDs. To act as a different user, use that user's ID instead. Use the user ID, not an email address.

The account ID is optional. Sim uses the user's default account unless you enter one, so you only need it when the user belongs to more than one account.

Add the credential to Sim

1. 1

   Open Integrations from your workspace sidebar

2. 2

   Search for "DocuSign" and open it, then click Add to Sim and choose Add JWT Grant app

3. 3

   Choose the Environment the integration key was created in: Developer (demo) or Production. A key that hasn't gone live only works in the developer environment

4. 4

   Paste the integration key, the impersonated user ID, the RSA private key, and optionally the account ID

5. 5

   Click Add JWT Grant app. Sim requests a token and reads the user's accounts once to check everything matches

Grant consent

DocuSign won't issue tokens for a user until that user (or an organization admin) consents to the integration key. The first time you add the credential, Sim shows an error with the exact consent link for your integration key and environment. Open the link signed in as the impersonated user and click Accept. DocuSign then redirects to the redirect URI you added; the page it lands on doesn't matter, so close it and add the credential again.

You only need to consent once per user and integration key, unless the user revokes it.

Use the credential in workflows

Add a DocuSign block and select the saved credential in the account dropdown. Every DocuSign operation works with it the same way as with a connected account. Sim calls the eSignature REST API for the account it found when it last requested a token, in the environment stored on the credential.

Knowledge base syncs from DocuSign can use the credential too. They read the same account in the same environment, and envelope links open in that environment's DocuSign web app.

Fix connection errors

To rotate the key, generate a new RSA keypair on the integration key, reconnect the credential in Sim with the new private key, test a workflow, then delete the old keypair. DocuSign allows up to five keypairs per integration key. See DocuSign's JWT Grant documentation.