Docusign JWT Grant type "invalid_grant" response

Question

We want to use our backend server to authenticate to docusign api (with admin consent) in order to create envelopes and prepare recipient views for the user to sign a document, and according to documentation, JSON Web Token (JWT) Grant seemed the way to go.

Following the documentation: https://developers.docusign.com/esign-rest-api/guides/authentication/oauth2-jsonwebtoken, I've created a JWT with the following payload:

{
  "iss": "INTEGRATOR_KEY",
  "sub": "USER_ID",
  "iat": 1559295213,
  "exp": 1559298213,
  "aud": "account-d.docusign.com",
  "scope": "signature impersonation"
}

The JWT is constructed on jwt.io, well formed and I sent the encoded version along the request. I also followed the steps of obtaining consent and added permissions to the app as in the scope from the payload: "signature impersonation".

I also tried making sure, that iat is for example now and exp is not longer then one hour after iat.

I am making the request via postman before integrating into our app:

POST https://account-d.docusign.com/oauth/token

Headers:

Content-Type:application/x-www-form-urlencoded

And body:

grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
assertion: ENCODED_JWT_FROM_ABOVE

I don't see anything being outside of the descriptions given in the documentation but am continuously receiving the same error:

{
    "error": "invalid_grant"
}

I checked other questions related to the issue but didn't find anything which worked for me, also being for the JWT grant, some of them were issues with the requests, ie headers, some of them with code while integrating it into the app. Wanted to share the whole flow to make sure if for my case I am doing everything properly.

EDIT: Additional note: When I go to my docusign admin panel, and under My Apps / Integration Keys the app does not seem to be running, this is just an assumption according to the grey status indicator (while I saw for users it is green):

I am not sure if some additional configuration is required, if the demo app or trial account have some limitations so would appreciate any input. Thanks!

Unfortunately, invalid_grant is an error that covers several possible failures. My recommendations for troubleshooting and next steps are over here: stackoverflow.com/questions/54836104/… — Drew

Larry K Larry K · Accepted Answer · 2019-06-02T18:30:26

Did you encrypt the JWT with your private key?

For sub did you use the user's guid (required) and not their email (won't work)?

Did you try using one of the eg-01 series of code examples which use JWT Grant authentication?

Check out Drew's answer for additional ideas.

Docusign JWT Grant type "invalid_grant" response

1 Answers