> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication: Salesforce client flow

## Authentication: Salesforce client flow

> **Warning**
>
> Developing with the CLM API is only available for CLM customers with a production account. To purchase a plan to gain access to the CLM API, contact [Docusign Sales](https://www.docusign.com/contact-sales).

With the Salesforce Client Flow, a Salesforce session token and the Org's Partner Server URL is used in place of a Docusign CLM refresh token to obtain a CLM API access token. To use this form of authentication the following setup is required:

1. The Salesforce Organization Id from which session tokens will be used must be mapped to a Docusign CLM account in the CLM account preferences. Docusign CLM supports a single one-to-one mapping of a Salesforce Org to CLM account. When the session token is passed to CLM, it will be verified and then a query is executed to determine the Salesforce organization from which the session originated. The Salesforce Client flow will then determine what CLM account that Salesforce organization is mapped to.
2. Users must be mapped in the CLM Address Book ahead of the authentication request. After determining the CLM account mapping, the Salesforce Client Flow will retrieve the user’s email address from Salesforce and try to map that to a user in the CLM account’s Address Book. Users can be provisioned in CLM using any supported user creation method. These include CLM user sync for Salesforce, bulk CSV upload, the CLM user interface, or the API.

> **Note:** If the Salesforce Org has installed CLM’s managed package for Salesforce and followed the setup instructions, the above 2 items should already be in place and no further action should need to be taken to start using the Salesforce Client Flow authentication method to the REST API.

The token endpoint for the Salesforce Client Flow and sample JSON request/response are shown below. Note that the Org’s Partner Server API URL must also be passed along with the Salesforce session ID:

>

**Production Salesforce Authentication Endpoint**

```text
https://auth.springcm.com/api/v201606/salesforce
```

**UAT Salesforce Authentication Endpoint**

```text
https://authuat.springcm.com/api/v201606/salesforce
```

> **Note:** The Partner WSDL SOAP endpoint can be obtained in a visual force page from the following global variable where xxx represents the version of the API: `{!$Api.Partner_Server_URL__xxx}`

The access token can now be used to access the API. It must be passed in the Authorization header for all calls to the Object, Task and Content API. When passing it must be prefixed with “bearer” as shown below:
`Authorization: bearer [your access token]`