> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication Overview

> This page gives an overview of authentication for CLM v2.0.

> **Warning**
>
> Developing with the CLM API is only available for CLM customers with a production account. To purchase a plan to gain access to the CLM API, contact [Docusign Sales](https://www.docusign.com/contact-sales).

Before your application can make calls to the CLM API, it must authenticate and obtain an access token. This access token proves your app’s identity and authorization. You must submit the token with each request.

You can use any Docusign-supported OAuth2 authentication workflow to obtain an access token and make calls to the CLM API: [Confidential Authorization Code Grant](/platform/auth/authcode#confidential-authorization-code-grant), [Public Authorization Code Grant](/platform/auth/authcode#public-authorization-code-grant), [Implicit Grant](/platform/auth/implicit), or [JSON Web Token (JWT) Grant](/platform/auth/jwt). Service integrations may use Confidential Authorization Code Grant or JWT Grant, while mobile apps may use Public Authorization Code Grant or Implicit Grant.

**Note**: Salesforce clients authenticate by using JWT Grant. For details, see [Salesforce Client Authentication](/docs/clm-api/clm101/salesforce-clients).

For an overview of these grant types and to determine the best grant type to use for your app, see [Authentication](/platform/auth) in the Platform 101 documentation.

## Prerequisites

Before you can use the Docusign CLM API, you need:

1. A [Docusign eSignature developer account](https://go.docusign.com/o/sandbox/) and a Docusign CLM account.
2. An [integration key](/platform/configure-app#integration-key) that identifies your app.
3. A defined redirect URI for your integration key. This is the URL to which Docusign will redirect the user's browser after authentication is complete.
4. You must also have configured your app correctly for the OAuth type you want to use. For details, see the instructions for the grant type you want to use under [Next steps](#next_steps).

## Required scopes

One of the differences between authenticating with the CLM API and the eSignature API is that, when you request an access token for your OAuth2 scenario, you must request a special CLM API [scope](/platform/auth#scopes) during the authentication process. You can combine CLM scopes with eSignature API scopes.

You can choose from the following CLM scopes:

| Scope          | Description                                                                                                                                                                                                                                                                                      |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `spring_read`  | Allows read access to all objects, including downloading documents.                                                                                                                                                                                                                              |
| `spring_write` | Allows write access to all objects, including uploading documents.                                                                                                                                                                                                                               |
| `content`      | Allows read and write access only to document content. This scope grants you access to download and upload documents, but does not grant access to other resources. If you are already requesting the `spring_read` and `spring_write` scopes, you don't need to also request the content scope. |

**Note**: The `impersonation` scope is also required when using the JWT flow.

Only request the scopes you need for your application.

* Using Authorization Code Grant, you request scopes when you make the authorization code request.
* Using Implicit Grant, you request scopes when you make the access token request.
* Using JWT Grant, you request scopes in the body of the JWT token.

## Authentication examples

The following examples show how to authenticate by using each grant type.

### Authorization Code Grant

Request URL:

```text
https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20spring_read%20spring_write&client_id=5c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://localhost/
```

### Implicit Grant

Request URL:

```text
https://account-d.docusign.com/oauth/auth?response_type=token&scope=spring_read%20spring_write%20signature&client_id=5c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://localhost/
```

### JSON Web Token (JWT) Grant

Request URL:

```text
https://account-d.docusign.com/oauth/auth?response_type=code&scope=impersonation%20content&client_id=5c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://localhost/
```

JSON request body:

```json
{
  "iss": "6c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f", "iat": 1541785491,
  "exp": 1561785491,
  "aud": "account-d.docusign.com",
  "scope": "signature content"
}
```

## Next steps

* See [Platform Authentication](/platform/auth) for an overview of each OAuth grant flow and how to choose which grant to use for your app.

* Learn how to implement each authentication flow by viewing these guides:

* [Confidential Authorization Code Grant](/platform/auth/authcode/confidential-authcode-get-token)

* [Public Authorization Code Grant](/platform/auth/authcode/public-authcode-get-token)

* [Implicit Grant](/platform/auth/implicit/implicit-get-token)

* [JSON Web Token (JWT) Grant](/platform/auth/jwt/jwt-get-token)

* To learn about JWT Grant authentication for Salesforce integrations, see [Salesforce Client Authentication](/docs/clm-api/clm101/salesforce-clients).