> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication

> Learn about the requirements to authenticate an app that uses the eSignature API.

## Authentication

Before your application can make calls to the Docusign eSignature API, it must authenticate and obtain an access token. This access token, which proves your app’s identity and authorization, must be submitted alongside each request to the Docusign eSignature API.

You can use any Docusign-supported OAuth2 authentication workflow to obtain an access token and make calls to the eSignature API: [Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token), [Public Authorization Code Grant](/platform/auth/public-authcode-get-token), [JSON Web Token (JWT) Grant](/platform/auth/jwt), or [Implicit Grant](/platform/auth/implicit). Service Integrations may use the Confidential/Public Authorization Code or JSON Web Token grants, while mobile apps may use the Public Authorization Code or Implicit Grants. See [Platform Authentication](/platform/auth) for an overview of these grants and how to choose which grant to use for your app.

## Required scopes

To make calls to the eSignature API, you must request the signature [scope](/platform/auth#authentication-scopes) during the authentication process.

* Using the Confidential or Public Authorization Code Grants, you request the signature scope when you make the the authentication code request
* Using the JWT grant, you request the signature scope in the body of the JWT token
* Using the Implicit grant, you request the signature scope when you make the access token request

For a walkthrough of how to get an access token using each flow, see [How to get an access token with Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token), [How to get an access token using Public Authorization Code Grant](/platform/auth/public-authcode-get-token), [How to get an access token with JWT Grant](/platform/auth/jwt-get-token), and [How to get an access token with Implicit Grant](/platform/auth/implicit-get-token).

## Next steps

* See [Authentication](/platform/auth) in the Platform 101 documentation for an overview of each OAuth grant and how to choose which grant to use for your app.
* Learn about how to implement each authentication flow by viewing and downloading code examples:

  * [Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token)
  * [Public Authorization Code Grant](/platform/auth/public-authcode-get-token)
  * [JSON Web Token (JWT) Grant](/platform/auth/jwt/jwt-get-token)
  * [Implicit Grant](/platform/auth/implicit/implicit-get-token)