> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Authentication reference

> Find reference information related to authentication, including a list of scopes and endpoints used in authentication scenarios.

This section contains reference information related to authentication, including a [list of scopes](/platform/auth/reference/scopes) and endpoints used in authentication scenarios.

For steps to troubleshoot common authentication errors, see this video:

## Endpoints

The Docusign authentication service resides on a different domain than the eSignature API service. Calls to authentication service endpoints use the following base paths:

* `https://account-d.docusign.com` for the development environment
* `https://account.docusign.com` for all production environments

Unlike other Docusign production APIs, the single `account.docusign.com` domain is used for all operations, worldwide.

> **Note:** For more information about authentication and how to authenticate, see [Choose an OAuth type](/platform/auth/choose).

The authentication service exposes three endpoints:

* [GET /oauth/auth](/platform/auth/reference/obtain-consent): This endpoint is used to obtain consent and is the first step in several authentication flows. It has different functions, depending on the query parameter values used.
* [POST /oauth/token](/platform/auth/reference/obtain-access-token): This endpoint enables you to exchange an authorization code or JWT token for an access token. This endpoint is called in most authentication flows.
* [GET /oauth/userinfo](/platform/auth/reference/user-info): This endpoint returns information on the caller, including their name, email, account, and organizational information. The response includes the `base_uri` needed to interact with the Docusign APIs.

## Error codes

The following table describes the codes that may be returned as values for the `error` parameter.

| Parameter                   | Description                                                                                             |
| --------------------------- | ------------------------------------------------------------------------------------------------------- |
| `invalid_redirect_uri`      | The `redirect_uri` supplied in the request did not match the value provided during client registration. |
| `user_cancelled`            | The user pressed the **Cancel** button.                                                                 |
| `unsupported_response_type` | The user requested a response type that is not supported.                                               |

## Next steps

* Explore the details of how to obtain access tokens using each grant:

  * See how to [obtain an access token with Confidential Authorization Code Grant](/platform/auth/confidential-authcode-get-token).
  * See how to [obtain an access token with Public Authorization Code Grant](/platform/auth/public-authcode-get-token).
  * See how to  [obtain an access token with Implicit Grant](/platform/auth/implicit-get-token).
  * See how to  [obtain an access token with JWT Grant](/platform/auth/jwt-get-token).
* Learn about options for [obtaining and revoking consent](/platform/auth/consent).