> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL. > > Documentation indexes by section: > - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt > - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt > - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt > - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt > > Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth > Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks > > OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json > MCP server: https://docusign.docs.buildwithfern.com/_mcp/server # Obtain access token endpoint > See how to use the Docusign authentication API's /oauth/token endpoint to obtain an access token with your specified scopes for calling Docusign APIs. The `POST /oauth/token` endpoint returns tokens based on your supplied parameters. You can use this endpoint to: * Exchange an authorization code for a refresh and access token, using the [Authorization Code Grant](/platform/auth/authcode) authentication flow. * Exchange a JWT for an access token using the [JSON Web Token (JWT) Grant](/platform/auth/jwt) authentication flow. * Exchange a [refresh token](/platform/auth/confidential-authcode-get-token#using-refresh-tokens) for an access token and a new refresh token. The syntax and parameters used for making a call to this endpoint differ, depending on your use case. See [JWT Grant](/platform/auth/jwt-get-token) and [Confidential Auth Code Grant](/platform/auth/confidential-authcode-get-token) for details and example API calls. If you are exchanging an authorization code for an access token using the [Authorization Code Grant](/platform/auth/authcode) flow, you must include the following call headers: | Name | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Content-Type` | A standard HTTP entity header indicating the media type of the resource. The value of `Content-Type` must be `application/x-www-form-urlencoded`. | | `Authorization` | The `Authorization` header contains your integration key and secret key, concatenated by a colon character, converted into [Base64](https://en.wikipedia.org/wiki/Base64) and prefixed with the word **Basic**. This value, together with the authorization code, is required to obtain an access token. For example, if your integration key is `7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f` and the secret key is `d7014634-xxxx-xxxx-xxxx-6842b7aa8861`, you can get the Base64 value in a JavaScript console with the following method call: `btoa('7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f:d7014634-xxxx-xxxx-xxxx-6842b7aa8861')` This method call results in a new `Authorization` header value: `NWMyYjhkN2.....hODg2MQ==` | | `refresh_token` | The full refresh token value that you originally received from authentication. This is only used if you are exchanging a refresh token for a new access token. | Calls to this endpoint have the following set of body parameters: | Name | Required? | Description | | ------------ | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `grant_type` | Yes | The type of grant being used: To exchange an authorization code for an access token, use `authorization_code`. To exchange a JWT for an access token, use `urn:ietf:params:oauth:grant-type:jwt-bearer`. | | `assertion` | Only used if you are exchanging an JWT for an access token. | The encoded value of a JWT token containing your authentication data. | | `code` | Only used if you are exchanging an authorization code for an access token. | The authorization code that you received from the callback. | After a successful call, the authentication service verifies that provided data is valid and returns the requested access token and metadata. The response contains the following fields: | Name | Type | Description | | --------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `access_token` | string | The value of the access token. This value will be added to the Authorization header of all Docusign API calls. | | `token_type` | string | The type of token. For access tokens, the value of this will be `Bearer`. | | `refresh_token` | string | A token that you can use to obtain a new access token without requiring user consent. The lifetime of a refresh token (typically around 30 days) can vary depending on business needs and is subject to change at any time. When you use a refresh token to authenticate, you can obtain a new refresh token with the following behavior: If you have obtained the extended scope, a new refresh token is issued with a full lifetime (typically 30 days). If you do not have extended scope, a new refresh token is issued that has the same expiration date as the original token (typically 30 days from the first login). **Note:** A refresh token is only returned in the Authorization Code Grant flow. | | `expires_in` | int | The number of seconds before the access token expires. When your access token expires, your application should request a new access token or, if you are using one of the Authorization Code Grants, get a new access token using your refresh token. | | `scope` | string | Each Docusign API defines a set of scopes. Each scope is required to perform a set of actions associated with that API. See [Authentication scopes](/platform/auth/reference/scopes) for the full list of available scopes and the APIs they are associated with. | ## Next steps * Learn more about [authentication](/platform/auth) in the Docusign platform. * See examples of to obtain an access token using the [Auth Code](/platform/auth/authcode), [Implicit](/platform/auth/implicit-get-token), and [JWT](/platform/auth/jwt-get-token) grants.