> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication

> Learn how to request Docusign Admin API scopes and authenticate to call the endpoints.

All calls to the Docusign Admin API are authenticated using an access token that your app obtains using one of the standard OAuth 2.0 grants supported by Docusign [:](/platform/auth/jwt/jwt-get-token)

* [Public Authorization Code Grant](/platform/auth/public-authcode-get-token)
* [Confidential Auth Code Grant](/platform/auth/confidential-authcode-get-token)
* [Implicit Grant](/platform/auth/implicit-get-token)
* [JWT Grant](/platform/auth/jwt-get-token)

**Note:** See [Choose an OAuth type](/platform/auth/choose) for details on when to use each authentication type.

When using the Admin API, you must request a special set of Docusign Admin scopes in addition to your other Docusign eSignature [Authentication scopes](/platform/auth/reference/scopes).

The list of Docusign Admin scopes that you can request and the types of operations that require them are listed below:

| Scope                             | Description                                                                                                                                                               |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `organization_read`               | Gets lists of organizations and organization data                                                                                                                         |
| `group_read`                      | Gets lists of groups associated with an account                                                                                                                           |
| `permission_read`                 | Gets lists of permission profiles associated with an account                                                                                                              |
| `user_read`                       | Reads user data                                                                                                                                                           |
| `user_write`                      | Updates, creates, or deletes users                                                                                                                                        |
| `account_read`                    | Gets account data                                                                                                                                                         |
| `account_write`                   | Updates, creates, or deletes account data                                                                                                                                 |
| `domain_read`                     | Gets data on reserved domains for the organization                                                                                                                        |
| `identity_provider_read`          | Gets data on identity providers for an organization                                                                                                                       |
| `user_data_redact`                | Deletes personal data for closed user accounts                                                                                                                            |
| `asset_group_account_read`        | Gets a list of organization accounts that indicates which accounts are [eligible to be cloned](/docs/admin-api/admin101/clone-accounts#source-accounts-must-be-compliant) |
| `asset_group_account_clone_write` | Initiates an [account cloning process](/docs/admin-api/admin101/clone-accounts#cloning-request-processing)                                                                |
| `asset_group_account_clone_read`  | Gets status and results for an [account cloning process](/docs/admin-api/admin101/clone-accounts#cloning-request-processing)                                              |
| `connect_org_config_read_api`     | Reads data for an Organization-Level Connect configuration                                                                                                                |
| `connect_org_config_write_api`    | Writes data for an Organization-Level Connect configuration                                                                                                               |
| `connect_org_oauth_read_api`      | Reads data for your Organization-Level Connect configuration OAuth settings                                                                                               |
| `connect_org_oauth_write_api`     | Writes data for your Organization-Level Connect configuration OAuth settings                                                                                              |
| `connect_org_hmac_read_api`       | Reads a list of the HMAC keys for your organization                                                                                                                       |
| `connect_org_hmac_write_api`      | Creates new HMAC keys for your organization                                                                                                                               |

**Important:** If the required Docusign Admin scopes were not explicitly requested, calls to the Docusign Admin API will fail.

## Application access tokens

When obtaining an access token using the [JWT Grant](/platform/auth/jwt), you can choose to create either a user-access token that impersonates an account user or an access token that represents an application, called an application-access token.

Application-access tokens can be used only for Docusign Admin API endpoints. They cannot be used with the eSignature or other Docusign APIs.

Application-access tokens are an alternative to using the JWT Grant to impersonate a user with account admin or organization privileges.

## Next steps

* See [How to send an envelope with extension app data verification fields](/docs/connected-fields-api/send-envelope-with-data-verification-fields) for a detailed walkthrough of how to send an envelope and validate the values of its connected fields.
* Learn how to get an access token with any authentication flow by viewing these guides:

  * [Authenticate with Public Authorization Code Grant](/platform/auth/public-authcode-get-token)
  * [Authenticate with the Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token)
  * [Authenticate with the Implicit Grant](/platform/auth/implicit-get-token)
  * [Authenticate with the JWT Grant](/platform/auth/jwt-get-token)