---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Set up Docusign eSignature spoke using JWT grant

# Set up Docusign eSignature spoke using JWT grant {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

Integrate the ServiceNow instance and Docusign by using JWT grant to authenticate ServiceNow requests.

## Before you begin

* Request an Integration Hub subscription.
* Activate the Docusign eSignature spoke.
* Role required: admin.

{#setup-docusign-jwt__ul_agy_qxd_rlb}  
Important:  
If you are setting up Docusign eSignature spoke using JWT grant, you need not set up the spoke using authorization code grant.

## Configure Docusign account {#ariaid-title2}

Create a custom OAuth application from your Docusign account to enable OAuth 2.0 authentication with the Docusign eSignature spoke.

### Before you begin

Docusign requirements:

* Docusign account
* Docusign app configured to integrate with ServiceNow
* Role required: Docusign administrator
{#configure-docusign-account__ul_nhk_cnh_gfb}

### About this task

Complete these steps from your Docusign account. See the [Docusign Developer Center](https://developers.docusign.com/) documentation for instructions on creating and configuring custom applications. Docusign uses a scripted webhook to send signed document data to ServiceNow instance. This enables flow designers to pause a flow until a document is signed, and use document data in the flow.

### Procedure

1. From your Docusign account, register your application.
2. Generate an integrator key and secret key.
3. Record the values of integrator key and secret key to register the app as a third-party OAuth provider on your ServiceNow instance.  
   You need these values when you [Register Docusign as OAuth Provider](https://www.servicenow.com/docs/t26Fm1Bv~kxwozf5YLBiFg#register-docusign-oauth-provider "Use the information generated during Docusign account configuration to register Docusign as an OAuth provider and allow the instance to request OAuth 2.0 tokens.")
4. Click ADD RSA KEYPAIR and record the Keypair ID, Public Key, and Private Key.
5. Add the ServiceNow OAuth Redirect URL in your Docusign account.
   1. Navigate to IntegrationsApp and Keys.
   2. Under Apps and Integration Keys,find the required app.
   3. For the required app, click the Actions drop-down list and click Edit.
   4. Under Additional settings, click Add URI and add the OAuth callback endpoint in this format: <kbd class="ph userinput">https://&lt;instance&gt;.service-now.com/oauth_redirect.do</kbd>.  
   {#configure-docusign-account__substeps_p45_dfd_p1c}
6. Obtain the value of Account Base URI from the Docusign account.
   1. Navigate to IntegrationsApp and Keys.
   2. Under My Account Information, you can find the value of the Account Base URI.  
   3. Copy and record this value for later use.
   {#configure-docusign-account__substeps_pl5_dfd_p1c}
{#configure-docusign-account__steps_zqw_yk3_qfb}

## Generate the JKS certificate {#ariaid-title3}

Generate a JKS certificate for the JWT authentication of the Docusign eSignature spoke.

### Before you begin

Role required: admin

### Procedure

1. Open the text editor for code such as, Sublime Text.
2. Create a new file.
3. Paste the Private Key you had earlier generated from your Docusign integrator app.  
   For more information, see [Configure Docusign account](https://www.servicenow.com/docs/t26Fm1Bv~kxwozf5YLBiFg#configure-docusign-account "Create a custom OAuth application from your Docusign account to enable OAuth 2.0 authentication with the Docusign eSignature spoke.").  
   Note:  
   Ensure that you include both beginning and ending of the private key.
4. Save the file with the .key extension, for example, <kbd class="ph userinput">privatekey.key</kbd>.
5. Open terminal and navigate to the directory where you saved the file with the .key extension.
6. Create a CA signed certificate using your private key by executing the command:  

       openssl req -new -x509 -key <file-name>.key -out <certificate-name>.pem -days 1095

   System prompts you to provide required details such as Country Name, Province Name and so on.
7. Enter the required details.
8. Create PKCS 12 file using your private key and CA signed certificate by executing the command:  

       openssl pkcs12 -export -in <certificate-name>.pem -inkey <file-name>.key -certfile <certificate-name>.pem -out <PKCS-12-file-name>.p12 

   System prompts you to provide a password.
9. Provide the export password.
10. Create the JKS file by executing this command:  

        keytool -importkeystore -srckeystore <PKCS-12-file-name>.p12 -srcstoretype pkcs12 -destkeystore <JKS-certificate-filename>.jks -deststoretype JKS

    System prompts you to provide a password.
11. Provide the destination and source keystore passwords.

## Attach a Java Key Store certificate to the Docusign eSignature spoke {#ariaid-title4}

Enable the JWT Bearer Grant token authentication by attaching a valid Java KeyStore
(JKS) certificate to the Docusign eSignature spoke.

### Before you begin

* Ensure the availability of a valid Java KeyStore certificate
* Role required: admin
{#upload-jks-certificate-docusign__ul_ss1_f4m_xgb}

### Procedure

1. Navigate to AllSystem DefinitionCertificates.
2. Click New.
3. Complete the form.  
   {#upload-jks-certificate-docusign__table_hvh_4tt_xgb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter a name to uniquely identify the record. For example, <kbd class="ph userinput">Docusign Certificate</kbd>. |
   | Notify on expiration | Define users to be notified when the certificate expires. |
   | Warn in days to expire | Enter the number of days to send a notification before the certificate expires. |
   | Active | Enable |
   | Type | Select Java Key Store. |
   | Expires in days | Enter the number of days until the certificate expires. |
   | Key store password | Enter a password associated with the certificate. |
   | Short description | Enter a summary about the certificate. |
   [Table 1. X.509 Certificate form fields]

   {#upload-jks-certificate-docusign__table_hvh_4tt_xgb}
4. Click the attachments icon (![Attachments icon]()) and attach a JKS certificate.
5. Click Validate Stores/Certificates.
{#upload-jks-certificate-docusign__steps_ifm_5dw_bhb}

## Create a JWT signing key for the Docusign eSignature spoke {#ariaid-title5}

Create a JSON Web Token (JWT) signing key to assign to your Java KeyStore
certificate.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllSystem OAuthJWT Keys.
2. Click New.
3. Complete the form.  
   {#create-jwt-key-docusign__table_jky_dk5_xgb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter a name to uniquely identify the JWT signing key. For example, <kbd class="ph userinput">Docusign JWT Keys</kbd>. |
   | Signing Keystore | Select the valid JKS certificate attached in the previous task. For example, <kbd class="ph userinput">Docusign Certificate</kbd>. |
   | Key Id | Enter a key Id to identify which key is used when multiple keys are used to sign tokens. |
   | Signing Algorithm | Select an algorithm to sign with the JWT key. |
   | Signing Key Password | Enter a password associated with the signing key. |
   | Active | Enable. |
   [Table 2. JWT Keys form fields]

   {#create-jwt-key-docusign__table_jky_dk5_xgb}
4. Click Submit.

## Create a JWT provider for the Docusign eSignature spoke {#ariaid-title6}

Add a JSON Web Token (JWT) provider to your
ServiceNow
instance.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllSystem OAuthJWT Providers.
2. Click New.
3. On the form, fill in the fields.  
   {#create-jwt-provider-docusign__table_l5g_3m5_xgb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter a name to uniquely identify the JWT provider. For example, <kbd class="ph userinput">Docusign JWT Provider</kbd>. |
   | Expiry Interval (sec) | Enter a number in seconds to set the lifespan of JWT provider tokens. |
   | Signing Configuration | Select a JWT signing key. For example, <kbd class="ph userinput">Docusign JWT Keys</kbd>. |
   [Table 3. JWT Provider form fields]

   {#create-jwt-provider-docusign__table_l5g_3m5_xgb}
4. Right-click the form header, and click Save.  
   The Standard Claims and Custom Claims related lists display.
5. On the same page of the JWT provider record, enter values for iss, sub, and aud in the Standard Claims related list.  
   {#create-jwt-provider-docusign__table_ijb_chj_tfc__entry__2}

   | Claim | Value |
   |-|-|
   | iss | <kbd class="ph userinput">&lt;your_integration_key&gt;</kbd> |
   | sub | <kbd class="ph userinput">&lt;your_user_ID&gt;</kbd> |
   | aud | <kbd class="ph userinput">account-d.docusign.com</kbd> |
   [ ]

   {#create-jwt-provider-docusign__table_ijb_chj_tfc}

   For more information, see [How to get an access token with JWT Grant](https://developers.docusign.com/platform/auth/jwt-get-token/) in [Docusign Developer Center](https://developers.docusign.com/).
6. Insert a record in the Custom Claims related list and complete the form.  
   {#create-jwt-provider-docusign__table_fcn_xm5_xgb__entry__2}

   | Field | Value |
   |-|-|
   | Claim Name | scope |
   | Claim Value Type | string |
   | Claim Value | signature impersonation |
   [Table 4. Custom Claims related list fields]

   {#create-jwt-provider-docusign__table_fcn_xm5_xgb}
7. Click Update.

## Register Docusign as OAuth Provider {#ariaid-title7}

Use the information generated during Docusign account configuration to register Docusign as an OAuth provider and allow the instance to request OAuth 2.0 tokens.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllSystem OAuthApplication Registry.
2. Click New.  
   The system displays the message What kind of OAuth application?
3. Select Connect to a third party OAuth Provider.  
   The system displays a blank Application Registries form.
4. Complete the form.  
   {#register-docusign-oauth-provider__table_alw_kq3_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Enter any name to uniquely identify the record. For example, enter <kbd class="ph userinput">Docusign OAuth</kbd>. |
   | Client ID | Enter the integrator key you generated during the Docusign account configuration. |
   | Client Secret | Enter the client secret you generated during the Docusign account configuration. |
   | Default Grant type | Select JWT Bearer. |
   | Authorization URL | * For developer sandbox environment, enter <kbd class="ph userinput">https://account-d.docusign.com/oauth/auth</kbd>. * For live production system, enter <kbd class="ph userinput">https://account.docusign.com/oauth/auth</kbd>. {#register-docusign-oauth-provider__ul_gyq_clg_zlb} |
   | Token URL | * For developer sandbox environment, enter <kbd class="ph userinput">https://account-d.docusign.com/oauth/token</kbd>. * For live production system, enter <kbd class="ph userinput">https://account.docusign.com/oauth/token</kbd>. For more information see, [Post Go-Live](https://developers.docusign.com/esign-rest-api/guides/post-go-live) and [User Info Endpoint Reference](https://developers.docusign.com/esign-rest-api/guides/authentication/user-info-endpoints) in the [Docusign Developer Center](https://developers.docusign.com/) documentation. {#register-docusign-oauth-provider__ul_lhw_2lg_zlb} |
   [ ]

   {#register-docusign-oauth-provider__table_alw_kq3_gfb}
5. Right-click the form header, and click Save.  
   * The system validates the OAuth credentials and populates the Redirect URL.
   * The system populates OAuth Entity Profile with Grant Type as JWT Bearer. For example, OAuth Entity Profile is created with default Name, Docusign OAuth default_profile
   {#register-docusign-oauth-provider__ul_gks_4f4_xgb}
6. Insert a record in the OAuth Entity Scopes related list and fill the values.  
   {#register-docusign-oauth-provider__table_mcz_fn5_xgb__entry__2}

   | Field | Value |
   |-|-|
   | Name | scope |
   | OAuth Scope | signature impersonation |
   [Table 5. OAuth Entity Scopes related list fields]

   {#register-docusign-oauth-provider__table_mcz_fn5_xgb}
7. Copy the value from Redirect URL.
8. Click Update.
9. Login to your Docusign account to edit the configuration of your custom Docusign application.  
   See the [Docusign Developer Center](https://developers.docusign.com/) for instructions.
10. Paste the Redirect URL value into the Redirect URI for your custom Docusign application.  
    For example, paste <kbd class="ph userinput">https://instance.service-now.com/oauth_redirect.do</kbd>
{#register-docusign-oauth-provider__steps_tcz_xq3_qfb}

### Result

The instance can request OAuth 2.0 tokens for the spoke.  
Note:  
When an OAuth token expires, the spoke automatically regenerates a new token in most cases. If a token expires and is not regenerated, an administrator can regenerate the spoke OAuth token.

## Obtain consent {#ariaid-title8}

Obtain explicit consent for the ServiceNow application from Docusign.
Role required: admin

### Obtain consent for an organization administrator {#obtain-consent-docusign__section_ont_v11_skb}

See [Docusign Developer documentation (Admin consent for internal applications)](https://developers.docusign.com/esign-rest-api/guides/authentication/obtaining-consent#admin-consent-for-internal-applications) for instructions to obtain consent for an organization administrator.

## Create Credential records for the Docusign eSignature spoke {#ariaid-title9}

Create Credential records to the Docusign custom OAuth application you created during Docusign account configuration. The Docusign spoke connection and credential alias uses these credentials to authorize actions.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsCredentials.
2. Click New.  
   The system displays the message What type of Credentials would you like to create?.
3. Select OAuth 2.0 Credentials.  
   The pop-up window displays a blank OAuth 2.0 Credentials form.
4. Fill these values.  
   {#configure-credential-docusign__table_sxv_zgp_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Enter any name to uniquely identify the record. For example, enter <kbd class="ph userinput">Docusign Credentials</kbd>. |
   | Active | Enable |
   | OAuth Entity Profile | Select the OAuth profile you created when you registered the custom Docusign application as an OAuth provider. For example, select Docusign OAuth default_profile. |
   | Applies to | Select the MID Servers that can use this credential. For example, select All MID Servers. |
   | Order | Select the order to apply this credential. For example, enter <kbd class="ph userinput">100</kbd>. |
   [ ]

   {#configure-credential-docusign__table_sxv_zgp_gfb}
5. Save the record.
6. Click the Get OAuth Token related link to generate the OAuth token.
{#configure-credential-docusign__steps_o5h_52j_qfb}

## Create Connection records for the Docusign eSignature spoke {#ariaid-title10}

Create Connection records to your Docusign account. The Docusign spoke connection and credential alias uses these connections to perform actions in DocuSsign.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsConnection \& Credential Aliases.
2. Open for the record for Docusign.
3. From the Connections tab, click New.  
   The system displays a blank HTTP(s) Connection form.
4. Enter these values.  
   {#configure-connection-docusign__table_any_shp_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Enter any name to uniquely identify the connection record. For example, enter <kbd class="ph userinput">Docusign Connection</kbd>. |
   | Credential | Select the Credential record you created for Docusign. For example, select Docusign Credentials. |
   | Connection URL | * For demo environment, enter <kbd class="ph userinput">https://demo.docusign.net</kbd>. * For live production system, enter the Base URI such as <kbd class="ph userinput">na2.docusign.net</kbd> or <kbd class="ph userinput">eu.docusign.net</kbd>. For instructions on obtaining the base URI, see [Post Go-Live](https://developers.docusign.com/esign-rest-api/guides/post-go-live) and [User Info Endpoint Reference](https://developers.docusign.com/esign-rest-api/guides/authentication/user-info-endpoints) in the [Docusign Developer Center](https://developers.docusign.com/) documentation. {#configure-connection-docusign__ul_yms_zng_zlb} |
   [ ]

   {#configure-connection-docusign__table_any_shp_gfb}
5. Click Submit.
{#configure-connection-docusign__steps_v1p_vhj_qfb}

### What to do next

Synchronize ServiceNow with Docusign to access Docusign accounts, templates, and envelopes from the Docusign spoke. See [Synchronize Docusign with ServiceNow](https://www.servicenow.com/docs/RKis_jeDvj2bb8xFSRyf~w "Synchronize ServiceNow with Docusign to access Docusign accounts, templates, and envelopes from the Docusign spoke.").

*[\>]: and then