Consent Require Error while requesting JWT access code

[hkarir0612]

I am working with DocuSign Sandbox to test the JWT authentication. I have setup everything that is mentioned in the DocuSign JWT document. I provided the user consent as well. But when I am trying to get the access token using postman I am still getting "Consent_required" error. Tried user consent URL multiple times but since I have already granted the permission the consent page doesn't show up. I am not understanding where exactly the issue is. Why even after giving "signature impersonation" consent I am still getting error. This is for individual consent.

[LarryKlugerDS]

Please see my comment on issue 111

Items to check:

• You can check to see if you have granted any consent by looking at the user's profile page.

• The profile page tells you that at least one consent scope was granted. But JWT Grant needs two scopes: signature and impersonation If you're receiving consent_required then one or both of the consents is missing.

  Best recommendation: re-do the consent process.

• When asking for consent, check that both scopes are requested. The consent agreement window from DocuSign must look like the following:

• Check that the right person has granted consent: when you use the JWT Grant flow, you must specify the guid of a DocuSign user. It is that user who must grant consent.

[hkarir0612]

Hi Larry,
Thank you for quick reply.
I revoked the grant for the user and again grant the permissions by hitting the user grant URL. I received the same agreement window and I click accept. But I am still getting the same error. I created another sandbox and tried same steps, everything worked correctly there. What might have been wrong with the one that's failing?

[hkarir0612]

I have repeated the revocation and granting permission steps multiple times. Its still giving me the same error. This is crazy!!

[LarryKlugerDS]

If the first sandbox was create awhile ago, it might have been set up with the wrong settings.
The fact that a newly created sandbox on demo.docusign.net is working for you correctly shows that your software is ok.

[LarryKlugerDS]

Closing this issue since the answer has been provided. Please comment if you feel the issue should be re-opened. Thank you.

[tapaz1]

I am also having this issue. I have worked with tech support to get the Organization Admin feature enabled, and have gone through the process of connecting the app and granting "impersonation" - still, I'm getting issues when simply trying to request an access token using the Node SDK apiClient requestJWTUserToken method.

I'm getting a 400 Bad Request - which doesn't even bubble up a useful error message even if I add a callback function as a parameter. It's only through drilling down into the API code in the Promise error callback that I see the body stating - "consent_required" error.

Please advise.. so far integrating with the SDK has been clunky, and is a huge turn off.

Also - there seems to be some inconsistency (at least it appears that way), in what the SDK uses and the API Explorer tool

[LarryKlugerDS]

Hi @tapaz1 ,

Thank you for your message. You're raising a number of issues, let's see if I can help:

I have worked with tech support to get the Organization Admin feature enabled, and have gone through the process of connecting the app and granting "impersonation" - still, I'm getting issues when simply trying to request an access token using the Node SDK apiClient requestJWTUserToken method.

Since your JWT grant flow is asking for both signature and impersonation scopes, you need to grant both of them administratively, not just impersonation. Try to add the signature scope via the admin tool to solve the issue.

I'm getting a 400 Bad Request - which doesn't even bubble up a useful error message even if I add a callback function as a parameter. It's only through drilling down into the API code in the Promise error callback that I see the body stating - "consent_required" error.

The latest version of the Java SDK is supposed to make the error code more accessible. Are you using the current version? Thank you.

Also - there seems to be some inconsistency (at least it appears that way), in what the SDK uses and the API Explorer tool

Yes, that's because you're using the JWT grant flow via the SDK and the API Explorer is using the Authorization Code grant flow.

[tapaz1]

Hey @LarryKlugerDS - thanks for the quick reply, I really appreciate it. Here is a screenshot of the admin permissions I've already granted - to no avail. Am I missing something?

Please feel free to reach out to my directly to trouble shoot easier. Not sure you do screen sharing or anything like that. My email is on my profile page.

Also to your other question - I'm using the latest version (think it's 5.2) of the NodeJS SDK - docusign-esign

Thanks

Lastly, maybe my use case might be helpful to help steer me in a good direction.

I'm trying to do the following:

1. A user visits my application and goes to a "contract" page
2. Programmatically I need to fetch a template I've added in the docuSign account that has been populated with standard fields that need to be filled out
3. Then, my code needs to fill out all the standard fields except the signature, and present the template/document to the user to sign
4. The user then signs the document (embedded in my app) to complete the signing ceremony all without requiring anyone to sign in, including me or anyone from the company

Hope that helps

[LarryKlugerDS]

Hi,
Administrative consent only works if you have also claimed the email domain that matches the domain of the user whom your JWT grant request is trying to impersonate. Have you done that?

Also, within the JWT grant request itself, you need to request signature scope. Are you doing that?

Lastly, for this type use case where your software just needs to impersonate a single user in the system--in this case a "system user" such as "Billing_dept@example.com", it may be easiest to use individual consent. Here's how:

To use individual consent:

1. Add a Redirect URI to your JWT integration key. You can use anything, eg https://www.yoursite.com/ DO NOT use your new application’s url
2. Wait 3 minutes by the clock to ensure that your update to the integration key has been propagated within the DocuSign system.
3. Use your browser to open url
   https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://www.yoursite.com/
4. You’ll be asked to login. Login as the user whose user id is the same guid that you are including with your JWT request. (If you’re not asked to login, then go to demo.docusign.com; login; logout; then try again)
5. You’ll be asked to grant consent to the two scopes: signature and impersonation.
6. You’ll be redirected to your home website. You’re done here, close the browser window.
7. Now go back to your new web portal application and re-run the JWT grant software. You should now receive back an access token and expires time.

[tapaz1]

Hi @LarryKlugerDS,

I have not done the email domain match (I don't recall seeing that in the docs). Do you have details on how to do this?

Per my previous post, I included a screenshot showing that I have already given the signature and impersonate permissions in the admin panel.

And the suggestion for individual consent is not a possible solution for us. Our application will be 100% automated, and used by external users. We simply want the authentication and handshake to happen programmatically so no one (us or the user) has to do anything other than visit a page, and see the contract to the begin the signing ceremony.

Thanks

[LarryKlugerDS]

Hi,
Claiming an email domain is documented starting on page 18 of the Organization Administration guide

The section is To prove ownership of a domain. The document implies that claiming a domain means using SSO. This is not true (the guide is being updated). The reality is that using SSO requires that a domain be claimed, and using administrative consent with an integration key also requires that a domain be claimed.

But Administrative consent for an integration key does not require SSO.

Also note that you need to grant impersonation scope; you spelled it wrong.

Re individual consent: sorry, I wasn't clear. Because your signers are external users, they do not have logins on DocuSign. -- Yes, this is standard and understood.

So you are using JWT to impersonate a specific DocuSign user in your account. That user will create the envelopes that your external signers will sign. That user is colloquially referred to as a "system user." For example, "finance@your-company.com".

You can use individual grant, one time, for finance@your-company.com to grant consent to your integration key. Once that's done, your web site app will be able to use JWT to obtain an access token for the finance@your-company.com user, create envelopes, and enable your web site visitors to sign them.

[hridya-ramesh]

Hello, @LarryKlugerDS,

If we have multiple DocuSign accounts in different datacenters like in EU and AU- then can we still claim domain? from the documentation I can see - one DocuSign organization -one domain What can we do in such scenarios? Do we have a workaround for granting consent on behalf of users from admin?

[LarryKlugerDS]

I will need to check. The issue is the separate DocuSign datacenters. You can also try it and report what happens. Here are the steps:

1. Organize your DocuSign accounts into one master DocuSign "organization". See the sections on creating an organization in the manual. Also see pg 76, Linking Accounts to an Organization.

   The goal is to have one DocuSign organization that includes the multiple DocuSign accounts.

   I don't know if one org can handle accounts from multiple DocuSign datacenters yet or not.

2. Then claim the email domains -- see the same documentation

3. Then use connected apps in the organization administration system to administratively grant consent to your integration keys.

[hridya-ramesh]

Hello, @LarryKlugerDS
I will try and see. Also would you recommend using "Admin consent for external applications" in such a scenario though the integration key belongs to our account?

[LarryKlugerDS]

Our product development group has confirmed that an organization can include accounts from multiple DocuSign sites.

No, I wouldn't use the external apps flow for your own integration keys

[hridya-ramesh]

Hello @LarryKlugerDS,

We do have admin enabled in demo account and for testing the JWT token auth- if we claim our domain from that account, will that in any way impact prod account? Just wanted to be sure before trying this one out

[LarryKlugerDS]

Good question. The good news is that claiming an email domain for use by demo.docusign.net is entirely separate from claiming it for a production DocuSign account. (And I’ve asked to have this made more specific in the documentation.) Test away! Regards, Larry

[hridya-ramesh]

Thanks Larry :)
Tested on demo and it worked. Is there any documentation on how to add accounts from different datacenters or DocuSign sites into one organization that I can refer to?

[LarryKlugerDS]

Yes, see the docs:

• Link accounts to your org. Note that the accounts can be in different DocuSign data centers.
• Claim email domains You must also claim the email domain to enable administrative consent. You do not need SSO for this.

[hridya-ramesh]

I saw these docs. But when I log in as admin on the main account and when I go inside the organization - it does not show link administered account option. The user is administrator with all permission. Also clicked on Link account - but it did not show any other account from different DocuSign sites. it was only showing accounts from this DocuSign site. So not sure what exactly am i missing here.

[LarryKlugerDS]

Are you sure that you have the org administration feature for your production accounts?

As a next step, you'll need to call/write our customer support group for help. Unfortunately I don't have the skills or access to help further with org questions.

[achaeleus]

Hi @LarryKlugerDS,

I am currently building an application using Java SDK and my call to apiClient.requestJWTUserToke has been successful in dev's account. We are about to go live and already linked our dev's account to prod's account, changed the endpoints and etc but when I test it i am getting a consent_required error. I watched one of your youtube videos and you noted there that I need to have an admin account so we purchased one and just waiting it to appear on my dashboard. Is that all we need for us to go on live?

[LarryKlugerDS]

Hi Jay, if you are having trouble with the consent_required error, I suggest:

1. See if my blog post is of help: https://www.docusign.com/blog/developers/oauth-jwt-granting-consent
2. Contact our Developer Support team. They're very good. Contact them via https://support.docusign.com/contactSupport
   Best is to login (using your DocuSign production credentials) then open a case with the portal. Or click on the API Integration button at the bottom of the page.

If you don't get through to developer support, then add a comment with your case id and I'll ask the team to contact you.
Thanks, Larry