Changelog

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

Learn More

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

Learn More

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

Learn More

Docusign is updating the domain structure for embedded signing URLs. When a recipient first opens an envelope, browsers are now directed to a unified domain (apps.docusign.com) instead of older site-specific URLs (such as www.docusign.net). This change primarily affects URLs generated by the createRecipientView API endpoint.

• URL length increase: The maximum length of the returned URL increases to 4,000 characters. Make sure your application can handle and redirect longer URL strings.
• No change to TTL: The time-to-live for these URLs remains 5 minutes.
• New URL format: Production URLs change from https://www.docusign.net/Signing/MTRedeem/v1/... to https://apps.docusign.com/authenticate?code=..., and demo URLs change from https://demo.docusign.net/... to https://apps-d.docusign.com/authenticate?code=....

No manual enablement is required. The change rolls out to demo from mid-October through early November 2026, and to production from mid-November to mid-December 2026.

Also rolling out to Direct customers between October 13 and November 24, 2026: the new eSignature sending experience becomes the default. Admins can now show or hide a user-facing toggle on the Add Fields page that lets users switch between the legacy and new experiences. Admins control the visibility of this toggle in Admin > Sending Settings.

Learn More

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

Learn More