Docusign JWT service authentication - using our own RSA key pair

0
votes

We are integrating our application with Docusign API using JWT service authentication method. Per the current docs, using the integrator key we need to generate new RSA key pair for each integrator key. Our multitenant integration to Docusign then requires us to generate RSA key pairs for each tenant and load them into our application.

In most public/private key/cert integration with other vendors we have seen that they allow using our own certs/keys. This is very convenient and simple since we only have deal with our own cert and not deal with storing many certs. Is there an option in Docusign to use/upload our own cert instead of creating new keys for every integrator id?

1
docusignapi

1 Answers

1
votes

Unfortunately there is not an option for you to upload a public key to DocuSign for JWT authentication.

However, your question implies an incorrect understanding of DocuSign Integration Keys (client_ids). Generally speaking, one application should have one integration key.

An Integration Key can be used by any number of DocuSign users, associated with any number of DocuSign accounts.

So your application can use the same integration key for all of its clients.

Added

While a DocuSign Integration Key (client id) can be used by any user, on any account, there is often confusion about the DocuSign account that manages the Integration Key:

When an Integration Key completes the Go Live process, a DocuSign paid account is set during the process to manage the Integration Key. That account's administrators have the ability to add/change/delete the Integration Key's settings including:

  • The valid redirect URIs
  • The valid private/public key pair(s) (for JWT apps)
  • The key's secret(s) for Authorization Code Grant apps

For a partner / ISV, they should create the Integration Key's Management Account DocuSign account as a minimal paid account that is only used to manage the Integration Key. When their customer uses the application with the customer's DocuSign user/account, the end user will be charged for sending envelopes, not the partner.

For DocuSign Partners in the partner program, a no charge partner account on the production platform is available. It only has the ability to manage the key. Partners should request a partner production account from their DocuSign partner representative.

It's usually better is for partners to purchase the smallest size of production account from DocuSign since it will enable testing on the production system.

Note that the Integration Key management account is any DocuSign account on the production system: the account can manage multiple IKs if needed and can also be used for the ISVs own production uses.