> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Salesforce Client Authentication

> **Warning**
>
> Developing with the CLM API is only available for CLM customers with a production account. To purchase a plan to gain access to the CLM API, contact [Docusign Sales](https://www.docusign.com/contact-sales).

Salesforce clients must authenticate by using Web Token (JWT) Grant. However, before you authenticate, you first need to configure your application’s connection to Docusign CLM.

## Prerequisites

Before you can authenticate your Salesforce client, you must:

* Have a [Salesforce developer account](https://developer.salesforce.com/signup).
* Have a [Docusign developer account](https://go.docusign.com/o/sandbox).
* Have created and configured an app in your Docusign Developer Account by following the steps in [Building a Docusign integration](/platform/build-integration).
* Have a Docusign CLM account.
* Have installed a package that creates custom metadata and written [Apex](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_intro_what_is_apex.htm) code that uses this package. To get started quickly, you can download [this example package](https://github.com/docusign/code-examples-clm-apex). For more information about Apex, see the [Apex Toolkit Overview](/docs/salesforce/salesforce101/apex-toolkit).
* Configure your Salesforce client to connect to Docusign.

## Required data

To authenticate your Salesforce client, you will need this information:

| Description     |                                                                                                                                                                                                                                                                                                                                                                                   |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API Account ID  | A globally unique identifier[(GUID)](http://guid.one/) value that identifies your account. To find your API Account ID, log in to your Docusign eSignature account and select **Admin**, then select[Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=apiIntegratorKey) from the sidebar. Copy the **API Account ID** value.                                       |
| User ID         | To find your User ID, log in to your Docusign eSignature account and select **Admin**, then select[Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=apiIntegratorKey) from the sidebar. Copy the **User ID** value.                                                                                                                                                |
| Integration Key | An [integration key](/platform/configure-app) that identifies your app. To find your integration key, log in to your Docusign eSignature account and select **Admin**, then select[Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=apiIntegratorKey) from the sidebar. Under **My Apps / Integration Keys**, copy the integration key for your Salesforce client. |
| Private Key     | The private key that you created and saved when you created and configured your app in your Docusign Developer Account by following the steps in [Building a Docusign integration](/platform/build-integration).                                                                                                                                                                  |

## Configure your Salesforce client to connect to Docusign

To configure your Salesforce client to connect with Docusign, you need to perform the following steps in the Salesforce web application.

### Set up custom metadata in Salesforce

#### Deploy the custom metadata and Apex package to Salesforce

1. If you have not already downloaded the [custom metadata and Apex package](https://github.com/docusign/code-examples-clm-apex), download it now.

2. Deploy the files in the package to Salesforce.org. You can use [Workbench](https://workbench.developerforce.com/login.php) for the installation.

3. Zip all of the files so that the folders and the .XML file in the **src** folder are at the root of the zip file.

4. Log in to Workbench and select **Migration > Deploy**.

5. Select the ZIP file that you downloaded. Check the **Single Package** checkbox and select **Next**.

6. Select **Deploy**.

#### Add your Docusign information to Salesforce

After you have successfully deployed the source files to your Salesforce organization, you need to add your Docusign information, such as your Docusign API User ID and API Account ID, to Salesforce as custom metadata. These values are used to generate the access token and connect to Docusign.

Log in to the Salesforce web application use these steps to add your Docusign information:

1. Select **Setup > Custom Metadata Types**.
2. Under **DocusignRESTSettings**, select **Manage Records**.
3. Enter the values for your Docusign instance in the following settings:

* **DSAccount**: Enter the Docusign API Account ID.
* **DSUserName:** Enter the Docusign User ID.
* **RequestIntegratorKey**: Enter the Integration Key.
* **RequestPrivateKey**: Enter the Private Key you created when you created and configured your app in your Docusign Developer Account.

### Set up Remote Site URLs in Salesforce

Next, in the **Remote Site Settings** area of the Salesforce web application, add the following Docusign URLs as **Remote Site URLs**:

1. `https://account-d.docusign.com` for demo accounts.
2. `https://account.docusign.com` for production accounts.
3. The appropriate REST API URL for your environment. You can find this in CLM Admin in the **Integrations** section of the **System Domains** page.

## Obtain consent to impersonate the user for API calls

Next, you need to ask the Docusign user to grant consent for your app to perform actions on their behalf. For service integrations, you can set up a service user and grant consent on this user's behalf.

**Note**: You will need to request special CLM-required scopes.

To complete this step, open this URI in a browser:

```text
https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation%20spring_read%20spring_write&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://localhost.com
```

Make sure that:

1. For the `client_id`, you substitute the correct Integration Key for `YOUR_INTEGRATION_KEY`.
2. The value for the `redirect_uri` parameter matches the redirect URI configured for the Integration Key in your Docusign Developer Account.

When you open the URL in your browser, a consent screen displays. Select **Accept**.

![Screenshot of the prompt for the user to grant consent](/_fern-files/_img/3c410819a5f8e4c9dd7eec0e42f750a98b19e5112ed61227886b23762c3341de.webp)

After you select **Accept**, you will be redirected to the redirect URI you specified.

## Next steps

To get started with using CLM objects, see [Object API](/docs/clm-api/clm101/object-api).