welcome to developing with docusign my name is aaron jackson wilde and i'm a member of the
developer center team this video is a continuation of our multi-part instructional series on how to
migrate your application to oauth 2.0 in this video i'll walk you through how to tell if you
are using non-oauth2 authentication and how to set up one of the recommended oauth 2.0 flows
specifically jwt authentication using the docusign e-signature php sdk migrating to
use oauth 2.0 has the following benefits you'll remove the potential impact of not complying with
privacy laws and policies as well as the legal liability of data loss if someone hacks your app
you'll eliminate the possibility of your app breaking when users change their login credentials
when you implement oauth 2.0 authentication you'll be able to manage your app through single sign-on
because we've deprecated legacy authentication we no longer document it when you move to oauth
you'll be able to take advantage of our documentation including how-to guides
best practice guidelines and troubleshooting now let's take a look at what legacy authentication
looks like in a php project and how to set up your integration to use oauth 2.0 instead
if your app uses the x docusign authentication or ws-security username token header
it is using legacy authentication and it must be updated to use oauth 2.0 legacy authentication
requires docusign credentials including account email password and an integration key
that information is passed as the value of the x docusign authentication header
now i'll recreate this code using the op methods provided by the docusign esignature php sdk but
first i'll need to gather some information from my apps and keys page to set up jwt authentication
i'll need to set my app's integration key rsa key redirect uri and an impersonated user guide i can
find these oauth elements on the apps and keys page under my account information i can find my
user id which all uses my impersonated user guide next to my app name i can find my integration key
to add an rsa private key and redirect uri i'll select the actions button then choose edit
under authentication service integrations rsa key pairs i'll select generate rsa make sure to save
your rsa private key in a secure location as it will not be accessible after closing this window
then under additional settings redirect uris i'll select add uri to add a redirect uri for my app
here i'll set up the variables to store my integration key redirect uri and impersonated user
guide i've pasted my rsa private key into a file named private key and set a variable to point to
that file's location i've also defined a variable to store the scopes i'll need for my api calls
scopes represent the oauth permissions that are being requested for e-signature rest api
methods use the signature scope if the access token will be used for other docusign apis
additional scopes may be required expires in defines how long the token will be valid
for once it's expired i'll need to generate a new access token the php sdk defines expiry in minutes
and has been set to 60 minutes here i'll also need to set a base path for the authentication service
this path differs depending on whether your app is in the development environment
or in production i'll use account d dot docusign.com
since this is the first time i'm authenticating my app with this specific set of scopes
i'll need to grant permission for the app to perform actions under those scopes
to get this consent construct a uri value matching the syntax shown that includes the authentication
base path your integration key scopes redirect uri and a response type value of code for jwt be sure
to include the impersonation scope in your consent url in the command line i run my code script
i paste the consent url in my browser and log in see the consent window and click accept the
response will navigate to the redirect uri now that i've granted consent i can obtain the access
token from the api client request jwt user token method now i'm ready to start making api calls i
can create the api client as before but this time i will add a default header with the authorization
as the key and the bearer access token as the value the rest of my code can remain intact now
i can run this simple code example which successfully lists the envelopes in my
developer account that have had status changes in the last 30 days you can use this same token to
make api calls while the token is valid you do not need to get a new token for every api call
that's it thanks for tuning in if you have any questions about how to develop your integration
with docusign here are some resources i recommend checking out the following leaks for more details
oauth 2.0 requirements and migration how to get an access token with jwt grant authentication
and recommended oauth 2.0 flows if you're watching from our youtube channel please post
questions and comments below the video or email us at developers docusign.com