# DocuSign JWT Grant (/integrations/docusign-service-account)

Connect DocuSign with JWT Grant when a workflow should keep working without anyone signing in again. Sim signs a short-lived assertion with your app's RSA private key, exchanges it for an access token that acts as one DocuSign user, and repeats that every hour. DocuSign issues no refresh token for JWT Grant, so nothing expires as long as the key and the user's consent stay in place.

Every envelope, template, and download runs as the impersonated user, with that user's DocuSign permissions. Use a dedicated user when you can.

## Prerequisites \[#prerequisites]

- A DocuSign account in the environment you want: a free developer account (demo) or a production account
- Admin access to **Apps and Keys** in that account, to create the integration key

## Create the integration key \[#creating-the-integration-key]

In DocuSign, open the **Apps and Keys** page and add an app. Give it a name (e.g. `Sim workflows`) and click **ADD**

Copy the integration key DocuSign assigns (a GUID)

Under **RSA key pair**, click **GENERATE RSA**. Copy the private key before you close the dialog, including its `BEGIN` and `END` lines. DocuSign masks it afterwards and can't show it again

Under **Redirect URI**, click **ADD URI** and enter the address you open Sim at (for example `https://sim.ai`). DocuSign requires a redirect URI for the consent step; Sim never uses what it receives there

Leave **User Application** set to **Yes** (the default) and click **SAVE**

Warning:

The private key lets anyone holding it act as any user who has consented to this integration key. Sim encrypts it at rest and never shows it again. Treat it like a password.

## Find the user ID \[#finding-the-user-id]

The **Apps and Keys** page shows your **User ID** and **API Account ID**, both GUIDs. To act as a different user, use that user's ID instead. Use the user ID, not an email address.

The account ID is optional. Sim uses the user's default account unless you enter one, so you only need it when the user belongs to more than one account.

## Add the credential to Sim \[#adding-the-credential-to-sim]

Open **Integrations** from your workspace sidebar

Search for "DocuSign" and open it, then click **Add to Sim** and choose **Add JWT Grant app**

Choose the **Environment** the integration key was created in: **Developer (demo)** or **Production**. A key that hasn't gone live only works in the developer environment

Paste the integration key, the impersonated user ID, the RSA private key, and optionally the account ID

Click **Add JWT Grant app**. Sim requests a token and reads the user's accounts once to check everything matches

## Grant consent \[#granting-consent]

DocuSign won't issue tokens for a user until that user (or an organization admin) consents to the integration key. The first time you add the credential, Sim shows an error with the exact consent link for your integration key and environment. Open the link signed in as the impersonated user and click **Accept**. DocuSign then redirects to the redirect URI you added; the page it lands on doesn't matter, so close it and add the credential again.

You only need to consent once per user and integration key, unless the user revokes it.

## Use the credential in workflows \[#using-the-credential-in-workflows]

Add a DocuSign block and select the saved credential in the account dropdown. Every DocuSign operation works with it the same way as with a connected account. Sim calls the eSignature REST API for the account it found when it last requested a token, in the environment stored on the credential.

Knowledge base syncs from DocuSign can use the credential too. They read the same account in the same environment, and envelope links open in that environment's DocuSign web app.

## Fix connection errors \[#fix-connection-errors]

| Error | What to check |
| - | - |
| Needs the impersonated user's consent | Open the consent link from the error signed in as that user, accept, and add the credential again. Consent can also be revoked later, which stops runs until it is granted again |
| Couldn't authenticate | The integration key, user ID, and private key must belong to the same app, in the environment you chose. A key created in the developer environment isn't valid in production until it goes live. A private key from a deleted keypair no longer works |
| User isn't a member of the account | The account ID you entered isn't one the user belongs to. Check it, or leave it blank |

To rotate the key, generate a new RSA keypair on the integration key, reconnect the credential in Sim with the new private key, test a workflow, then delete the old keypair. DocuSign allows up to five keypairs per integration key. See [DocuSign's JWT Grant documentation](https://developers.docusign.com/platform/auth/jwt/jwt-get-token/).