> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Application-access tokens

> For use only with the Docusign Admin API, Application-access tokens are an alternative to using the JWT Grant to impersonate a user with account admin or organization privileges.

When obtaining an access token using the [JWT Grant](/platform/auth/jwt), you can choose to create either a user-access token that **impersonates** an account user or an access token that represents an application, called an *application-access token*.

Application-access tokens can be used only for [Docusign Admin API](/docs/admin-api) endpoints. They cannot be used with the eSignature or other Docusign APIs.

Application-access tokens are an alternative to using the JWT Grant to impersonate a user with account admin or organization privileges.

## Creating an application-access token

To create an application-access token, follow the process to [obtain an access token with JWT Grant](/platform/auth/jwt-get-token). When you create the JWT token, **do not set the sub (subject) claim in the JWT body**. After exchanging the JWT for an access token, you will receive an application-access token.

You can only create application-access tokens for authorized apps. To authorize an app:

1. In the **Docusign Admin** dashboard, select **Connected Apps**.
2. Select **Authorize Application**.
3. Select the application belonging to one of your organization’s accounts to be authorized, then list the [scopes](/platform/auth/reference/scopes) that application will be given in space delimited format.
4. Select **Add**.

## Next steps

* Learn more about [JWT Grant](/platform/auth/jwt).
* Read how to [obtain an access token with JWT Grant](/platform/auth/jwt-get-token).
* Watch the [Get an access token with JWT Authentication video](https://www.youtube.com/watch?v=ebwN2HWpDQA).  Note that, unlike the normal JWT flow, you should omit the sub claim within the body of your JWT in order to get an application-access token.