0

We have been working on org where there's a one-time manual setup page to authenticate with Docusign API using Oath flow and store the Access token and Refresh token in a custom setting. If any other VF page needs to call the Docusign API, it would get the refresh token and get the new access token do all the API calls.

Current Flow:

1) Click on the button in VF page

2) Page redirects to the DocuSign login page

3) Integration User gives the username and password

4) Docusign ask for Grant Permission screen on click on Accept based on the callback URL configured, the page gets redirected with "code" which contains the encoded data of "access token", "refresh token"..

The client wants us to remove this one-time manual setup if possible and do all the authentication behind the scene in Apex without manual intervention

While searching different authentication flows, we came across the passing the Username and Password in the header(https://developers.docusign.com/esign-rest-api/guides/authentication/legacy) instead of using Oath's access token but it is legacy approach and is not recommended by DocuSign

So upon searching we found JWT flow(https://developers.docusign.com/esign-rest-api/guides/authentication/oauth2-jsonwebtoken) to authenticate with DocuSign but it seems like it will ask the "Grant Permission" screen.

My question here,

Is there's a way to make the authentication flow happen in Apex without any manual user interaction? If so, can you please share how it can be done in Apex?

NOTE: Org does not contain the DocuSign package installed. Current, all the flow and access the DocuSign resource is based on custom code.

2 Answers 2

2

You shouldn't be trying to bypass the Grant Access screen. While it is an inconvenience to users to have to grant access, it is an important component of account security. You could choose to move to the Implicit Grant Authentication, but then you don't get a Refresh token, so you will need to regularly call the login API, and you'll have to store the username and password directly, which can cause its own issues. Explain to your client(s) that this is a security feature that should not be tampered with. While it is technically feasible to bypass this, using either the implicit grant or by somehow parsing the grant access screen to figure out what to post back to the server, it's not a good idea to try to bypass security features.

1

The client wants us to remove this one-time manual setup if possible and do all the authentication behind the scene in Apex without manual intervention

I know how difficult it can be at times to address such scenarios. But there are reasons why few things should not be done the way its asked.


You cannot skip the authentication step (when it asks for user credentials) if you want to get the refresh token. You can mention something as below if that helps them to provide some context:

  1. It's how the refresh token flow works. You need to go through this step if you want to utilize a refresh token approach
  2. It's still ONE TIME. So you may need to address it that way that no other User will always need to perform that

You can only skip the authentication step, if you use a password grant flow (for DocuSign Implicit Grant). But the trade-off here is that you don't get the refresh token in this case, instead you will need to fetch the access token every time to be able to make a callout to the endpoint.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .