> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication

> Learn about authentication options for Web Forms API integrations.

> **Note**
>
> The Web Forms API is available in all developer accounts, but only in certain production account plans. Contact [Docusign Support](https://support.docusign.com/s/?language=en_US) or your account manager to find out whether the Web Forms API is available for your production account plan.

Before your application can make calls to the Web Forms API, it must authenticate and obtain an access token. You must submit this access token, which proves your application’s identity and authorization, with each request.

You can use these supported OAuth2 authentication workflows to obtain an access token and make calls to the Web Forms API:

* [Authorization Code Grant](/platform/auth/authcode): For the highest level of security, Docusign recommends using this authentication method when possible.
* [Implicit Grant](/platform/auth/implicit): This authentication method can be used with public clients, as defined in [RFC 6749 section 2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1). Implicit Grant must be used for applications that are not able to store sensitive data on a secure server.
* [JSON Web Token (JWT) Grant](/platform/auth/jwt): With this authentication method, the access token impersonates a user, also known as an *account member*. Use JWT Grant for heavily automated applications that call the Docusign platform without direct user interaction.

See the [platform authentication overview](/platform/auth) for a description of these grants and how to choose between them.

## Required scopes

When you request an access token for your OAuth2 scenario, you must request Web Forms API [scopes](/platform/auth/reference/scopes) during the authentication process.

> **Note**
>
> The eSignature REST API `signature` scope is required for Web Forms API requests, in addition to Web Forms API scopes. For JWT Grant, the `impersonation` scope is also required.

The Web Forms API supports these scopes:

| Scope                     | Description                                                                                                                                                              | Required for these requests                                                                                                                                                         |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `webforms_read`           | Allows an application to retrieve information about [web form configurations](/docs/web-forms-api/web-forms-101/concepts#web-form-configurations) defined in an account. | [Configurations:getForm](/docs/web-forms-api/reference/webforms/configurations/getform) [Configurations:listForms](/docs/web-forms-api/reference/webforms/configurations/listforms) |
| `webforms_instance_read`  | Allows an application to retrieve information about [web form instances](/docs/web-forms-api/web-forms-101/concepts#web-form-instances).                                 | [Instances:getInstance](/docs/web-forms-api/reference/webforms/instances/getinstance) [Instances:listInstances](/docs/web-forms-api/reference/webforms/instances/listinstances)     |
| `webforms_instance_write` | Allows an application to create web form instances and refresh [instance tokens](/docs/web-forms-api/plan-integration/expirations-timeouts#instance-token-expiration).   | [Instances:createInstance](/docs/web-forms-api/reference/webforms/instances/createinstance) [Instances:refreshToken](/docs/web-forms-api/reference/webforms/instances/refreshtoken) |
| `signature`               | Used for operations on the Docusign eSignature API.                                                                                                                      | Required for requests to all Web Forms API endpoints.                                                                                                                               |

The scopes request is included in these authentication flow components:

* **Authorization Code Grant:** The authorization code request
* **Implicit Grant:** The access token request
* **JWT Grant:** The body of the JWT token

See [Authentication examples](/docs/web-forms-api/plan-integration/authentication#authentication-examples) for details.

## Authentication examples

### Authorization Code Grant

#### Request URL

```text
https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20webforms_read%20webforms_instance_read%20webforms_instance_write&client_id=7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://example.com/callback/
```

### Implicit Grant

#### Request URL

```text
https://account-d.docusign.com/oauth/auth?response_type=token&scope=signature%20webforms_read%20webforms_instance_read%20webforms_instance_write&client_id=7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://example.com/callback/
```

### JSON Web Token (JWT) Grant

#### Request URL

```text
https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation%20webforms_read%20webforms_instance_read%20webforms_instance_write&client_id=7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f&redirect_uri=http://example.com/callback/
```

#### JSON request body

```text
{
  "iss": "5c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f",
  "sub": "464f7988-xxxx-xxxx-xxxx-781ee556ab7a",
  "iat": 1705602811,
  "exp": 1705606811,
  "aud": "account-d.docusign.com",
  "scope": "signature impersonation webforms_read webforms_instance_read webforms_instance_write"
}
```

## Next steps

* See [Authenticate](/platform/auth) in the Platform 101 documentation for an overview of each OAuth grant and how to choose which grant to use.
* Learn about how to implement each authentication flow by viewing these guides:

  * [Authorization Code Grant](/platform/auth/confidential-authcode-get-token)
  * [Implicit Grant](/platform/auth/implicit-get-token)
  * [JWT Grant](/platform/auth/jwt-get-token)

    For the Web Forms API, you do not need to complete the step **Get your user's base URI** in these guides. See [Production data center autorouting](/docs/web-forms-api/web-forms-101/endpoint-base-path#production-data-center-autorouting) for more information.