← Back to eSignature Overview · Core Primitive

@memberjunction/esignature-docusign

The DocuSign driver for the MemberJunction eSignature subsystem. It implements the BaseSignatureProvider contract against the DocuSign eSignature REST API, using JWT-grant OAuth for server-to-server authentication.

This is the reference provider — it implements the full feature set, including templates, embedded signing, and DocuSign Connect webhooks.

npm install @memberjunction/esignature-docusign
Copy

You don't call this package directly. You configure a DocuSign Signature Account and use the SignatureEngine (or the no-code Actions). The engine resolves and drives this provider for you.

At a glance

Supported operations

How authentication works

DocuSign uses JWT grant — the driver signs a JWT with your RSA private key and exchanges it for a short-lived access token, with no interactive login. Tokens are obtained on demand and refreshed automatically.

sequenceDiagram
    participant Drv as DocuSign Driver
    participant OAuth as DocuSign OAuth Server
    participant API as DocuSign REST API

    Drv->>Drv: Sign JWT with privateKey
(iss=integrationKey, sub=userId, aud=oauthBase)
    Drv->>OAuth: POST /oauth/token (JWT grant)
    OAuth-->>Drv: Access token
    Drv->>API: Authorized request (envelopes, status, …)
    API-->>Drv: Response
Copy

Configuration

These values live in the account's Credential (encrypted via the Credential Engine) — never in code or environment variables. Non-secret defaults (oauthBase, restBase) may also be set on the Signature Provider record.

The defaults point at the DocuSign demo environment, so you can test immediately. Override oauthBase and restBase for production.

One-time setup

1. In the DocuSign Admin console, create an integration key with JWT grant and upload an RSA keypair.
2. Grant the app consent for the impersonated user (one-time admin consent URL).
3. In MemberJunction:
   • The DocuSign Signature Provider row is already seeded.
   • Create a Credential holding integrationKey, userId, accountId, and privateKey.
   • Create a Signature Account pointing at that credential.
4. (Production) Configure a Connect webhook in DocuSign pointing at POST {your-server}/esignature/webhook/DocuSign, and store its HMAC secret as connectHmacKey.

Status mapping

DocuSign's native envelope statuses map onto MemberJunction's normalized lifecycle:

Webhooks (DocuSign Connect)

DocuSign Connect pushes envelope events to POST /esignature/webhook/DocuSign. The driver verifies the x-docusign-signature-1 header as an HMAC over the raw request body using your connectHmacKey. If the key is configured and the signature doesn't match, the event is logged and the envelope status is left unchanged — see the webhook flow.

Testing

cd packages/eSignature/Providers/DocuSign && npm run test
Copy

Related