> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authenticate

> Determine which type of OAuth flow is right for your app.

> **Note**
>
> New to Docusign authentication? Get started quickly and easily using our [Quickstart](/docs/esign-rest-api/quickstart) tool.

> **Note**
>
> We’re currently running a beta for the Docusign Developer AI Assistant for VS Code, an AI-powered assistant to help developers generate tokens, orchestrate APIs, configure brands, and resolve integration issues faster. Install the extension from the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=DocuSign.docusign-copilot).

Docusign uses OAuth 2.0 to secure your API requests. Using OAuth, your app requests access and performs actions, such as requesting a signature, on behalf of one of your users.

Docusign provides four scenarios for implementing OAuth:

* [Authenticate with the Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token)
* [Authenticate with Public Authorization Code Grant](/platform/auth/public-authcode-get-token)
* [Authenticate with the Implicit Grant](/platform/auth/implicit-get-token)
* [Authenticate with the JWT Grant](/platform/auth/jwt-get-token)

A fourth OAuth flow, [OAuth for Docusign Connect](/platform/webhooks/connect/validation-and-security/oauth-connect), is for apps that receive Docusign Connect event notification messages. It enables you to authenticate that the Connect notification messages your app receives are from Docusign. Unlike the three grants listed above, it does not grant you an access token for making API calls to the Docusign platform.

How you implement OAuth will depend on your app’s needs. Determine the right OAuth type for your app with this decision tree.

![Image showing a decision tree that recommends different types of Docusign OAuth, depending on your ](/_fern-files/_img/68a38e81f90d85fb610e6dc7b8efe5381da07d9f5373ba617f26088677d3d3f8.webp)

* Both the **Confidential Authorization Code Grant** and **Public Authorization Code Grant** require that the user be present when your session starts, but are simpler to implement than JWT Grant and provide a refresh token that you can use to remain authenticated.

  Both of these grants provide equivalent levels of security, but the **Confidential Authorization Code Grant** requires a secret key and the **Public Authorization Code Grant** does not.
* The **JWT Grant** does not require that your users are present at the start of a session. If you use a single login for all users in your app or manage large numbers of users, you should use the JWT Grant.

Regardless of the way you authenticate, the access token that you receive is the same. If you include this access token in an API request, your request is authenticated and access to the API is granted.

**Note:** When you create a new integration, we recommend that you begin working from a pre-provisioned app that already implements any supported OAuth scenario. See [Build a Docusign integration](/platform/build-integration) for details.

**Walkthrough video** You can also see a video overview of authentication at Docusign below:

## Authentication scopes

Each time your app authenticates, it must request one or more scopes. A scope is a set of permissions for an API that the app needs to do its work. Each scope is typically specific to a Docusign API. For example, you must request the signature scope to perform most operations on the REST eSignature API.

To see the full list of all supported scopes, see [Authentication scopes](/platform/auth/reference/scopes).

## OAuth for Connect

OAuth for Connect is an OAuth flow but, unlike the three flows above, it does not grant your app an access token for making API calls. Instead, it can support your existing OAuth security requirements for [Docusign Connect](/platform/webhooks/connect). See [OAuth for Docusign Connect](/platform/webhooks/connect/validation-and-security/oauth-connect) for details.

## Next steps

* See details about [Confidential Authorization Code Grant](/platform/auth/authcode#confidential-authorization-code-grant), [Public Authorization Code Grant](/platform/auth/authcode#public-authorization-code-grant),[Implicit Grant authentication](/platform/auth/implicit), and [JSON Web Token (JWT) Grant](/platform/auth/jwt).
* See how to use [OAuth for Docusign Connect](/platform/webhooks/connect/validation-and-security/oauth-connect) to authenticate that your event notification messages are from Docusign.
* Learn about how to implement each authentication flow by viewing and downloading code examples:

  * [How to get an access token using Public Authorization Code Grant](/platform/auth/public-authcode-get-token)
  * [How to get an access token with Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token)
  * [How to get an access token with Implicit Grant](/platform/auth/implicit-get-token)
  * [How to get an access token with JWT Grant](/platform/auth/jwt-get-token)

> Determine which type of OAuth flow is right for your app.

## Docs

- [Choose OAuth Type](https://developers.docusign.com/platform/auth/choose.md): Provides guidance for how to choose the right OAuth Grant for your integration
- [Authorization Code Grant authentication](https://developers.docusign.com/platform/auth/authcode.md): Learn about the Authorization Code Grant OAuth flows and when you should implement them for your app.
- [Implicit Grant Authentication](https://developers.docusign.com/platform/auth/implicit.md): Learn about the Implicit Grant OAuth flow and when you should implement it for your app.
- [JSON Web Token (JWT) Grant authentication](https://developers.docusign.com/platform/auth/jwt.md): Learn about the JSON Web Token (JWT) OAuth flow and when you should implement it for your app.
- [JWT Grant implementation and best practices](https://developers.docusign.com/platform/auth/jwt/jwt-best-practice.md): Provides best practices and guidance for implementing JWT Grant in your integration.
- [How to get an access token using Public Authorization Code Grant](https://developers.docusign.com/platform/auth/public-authcode-get-token.md): Find out how to use the Public Authorization Code Grant to get an access token without needing to secure a client secret.
- [How to get an access token with Confidential Authorization Code Grant](https://developers.docusign.com/platform/auth/confidential-authcode-get-token.md): Find out how to use the Docusign Authentication Service authorization code grant for user applications when your application has a server component that can protect its secret key.
- [How to get an access token with JWT Grant](https://developers.docusign.com/platform/auth/jwt-get-token.md): Demonstrates how to get an access token using JSON Web Token (JWT) Grant authentication.
- [How to get an access token with Implicit Grant](https://developers.docusign.com/platform/auth/implicit-get-token.md): Find out how to use the Docusign Authentication Service Implicit Grant for user applications.
- [OAuth 2.0 requirements and migration](https://developers.docusign.com/platform/auth/oauth2-requirements-migration.md): Describes the steps and considerations needed to migrate from legacy authentication to OAuth
- [Obtain and revoke consent](https://developers.docusign.com/platform/auth/consent.md): Learn how to obtain consent from your users or revoke consent from an app.
- [How to obtain individual consent](https://developers.docusign.com/platform/auth/consent/obtaining-individual-consent.md): Demonstrates how to obtain individual consent for an app to act on their behalf in the eSignature API.
- [How to obtain admin consent for internal applications](https://developers.docusign.com/platform/auth/consent/obtaining-admin-consent-internal.md): Describes the procedure for obtaining admin consent for internal applications
- [How to obtain admin consent for external applications](https://developers.docusign.com/platform/auth/consent/obtaining-admin-consent-external.md): Integration developers can obtain consent from another organization’s users by having an admin of that organization grant consent on their users’ behalf.
- [Authentication reference](https://developers.docusign.com/platform/auth/reference.md): Find reference information related to authentication, including a list of scopes and endpoints used in authentication scenarios.
- [Obtain consent endpoint](https://developers.docusign.com/platform/auth/reference/obtain-consent.md): You can redirect a user’s browser window to the GET /oauth/auth endpoint to obtain consent. This is the first step in several authentication scenarios. It has different functions when supplied with different parameters.
- [Obtain access token endpoint](https://developers.docusign.com/platform/auth/reference/obtain-access-token.md): See how to use the Docusign authentication API's /oauth/token endpoint to obtain an access token with your specified scopes for calling Docusign APIs.
- [User info endpoint](https://developers.docusign.com/platform/auth/reference/user-info.md): Learn about the /oauth/userinfo endpoint, which returns account information and the base URI needed to interact with the Docusign platform APIs.
- [Logout endpoint](https://developers.docusign.com/platform/auth/reference/logout.md)
- [Authentication scopes](https://developers.docusign.com/platform/auth/reference/scopes.md): Lists and describes the scopes used by each API in the Docusign platform.