> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# New PHP Click SDK version 2.0.0 released

* Raised minimum PHP version: The SDK now requires PHP \~8.2.35, \~8.3.36, \~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
* Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
* RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a `DomainException`.
* Lowercase response headers: Header arrays returned by the `*WithHttpInfo` methods and by `ApiException::getResponseHeaders()` now use lowercase keys (for example, `content-type`).
* Fixed: Removed deprecated `utf8_decode()` calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

[Learn More](https://packagist.org/packages/docusign/click-client#v2.0.0)