> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Docusign

> Connect Docusign to Iru Compliance using OAuth JWT Grant with an integration key, RSA keypair, and consent to collect envelope and account evidence.

### About Docusign

Iru calls the **eSignature REST API** using **OAuth 2.0 JWT Grant**: you register an **Integration Key** (**client ID**), upload an **RSA public key**, grant **impersonation consent** for a service user, and Iru exchanges a **signed JWT** for **access tokens**. This suits **server-to-server** automation without interactive consent each hour.

### How It Works

DocuSign supports several OAuth 2.0 grant types; for Iru’s **server-to-server** connector, **JWT Grant** is the right model: you create an **Integration Key** (**client ID**), configure an **RSA keypair**, grant **impersonation consent** once for the user Iru acts as, and Iru exchanges a **signed JWT** for **access tokens** against the eSignature REST API.

| Detail             | Value               |
| ------------------ | ------------------- |
| **Category**       | E-signatures        |
| **Authentication** | OAuth 2.0 JWT Grant |

High-level steps: **Apps and Keys** → create **Integration Key** → **JWT** auth → generate or upload **RSA** → capture **Integration Key**, impersonated user **GUID**, **account base URI**, and **private key** per Iru’s wizard.

Official references: [Platform auth](https://developers.docusign.com/platform/auth/), [JWT Grant](https://developers.docusign.com/platform/auth/jwt/jwt-get-token/), [Build integration](https://developers.docusign.com/platform/build-integration/), [eSignature REST](https://developers.docusign.com/docs/esign-rest-api/).

### Prerequisites

* **Administrator** access in Docusign.
* **developers.docusign.com** access to manage integrations.
* Clear choice of **demo** vs **production** keys and OAuth hosts (`account-d.docusign.com` vs `account.docusign.com`).

### Connect Docusign to Iru

<Tabs>
  <Tab title="Docusign">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Open Apps and Keys">
        Sign in to the correct Docusign environment (**demo** vs **production**). Open **Settings** → **Apps and Keys** (wording can vary slightly by account type).
      </Step>

      <Step title="Add an app and integration key">
        Select **Add App and Integration Key** (or **Create app**). Name the app so operators recognize it (for example **Iru Compliance**). Copy the **Integration Key**; this is your OAuth **client ID** for JWT.
      </Step>

      <Step title="Enable JWT Grant">
        In the app’s authentication settings, enable **JWT Grant** for server-to-server use. Save changes if Docusign prompts you.
      </Step>

      <Step title="Generate or upload RSA keys">
        Under **Service Integration**, choose **Generate RSA** (or upload your public key per Docusign’s docs). Download the **private key** immediately and store it in a vault. You cannot retrieve the private key from Docusign later.
      </Step>

      <Step title="Grant impersonation consent">
        Open the **consent URL** Docusign provides for JWT (scopes typically include **`signature`** and **`impersonation`**). Sign in as the **user to impersonate** and click **Allow**. Complete any redirect your app registration requires.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Docusign**](#docusign) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Docusign">
        Find **Docusign** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter Integration Key and user ID">
        In the wizard, paste the **Integration Key** (**client ID**) and the impersonated user **ID** (**GUID**) for the account Docusign should act as.
      </Step>

      <Step title="Enter private key and REST base URI">
        Paste the **RSA private key** and the **REST base URI** for your account (for example `https://na4.docusign.net/restapi`). If you are unsure of the base URI, discover it via **`/oauth/userinfo`** as Docusign documents.
      </Step>

      <Step title="Finish the connection">
        **Submit** the configuration (match the label in your wizard; the vendor flow calls this **Submit the configuration**). When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Docusign** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="consent_required">
    Finish browser consent for impersonation.
  </Accordion>

  <Accordion title="invalid_grant / JWT errors">
    Private key matches uploaded public key; server clock accurate.
  </Accordion>

  <Accordion title="Wrong base URI">
    Resolve regional **`restapi`** host from Docusign account metadata.
  </Accordion>

  <Accordion title="Sandbox vs production">
    Keys and OAuth hosts must match the environment.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Access tokens expire about hourly: JWT Grant re-runs…" icon="circle-info">
    Access tokens expire about hourly - **JWT Grant** re-runs automatically; protect the **RSA private key** like a production secret.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>