Docusign eSignature setup guide

Agents prepare documents and send them for signature.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Docusign eSignature, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Docusign eSignature can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Your Docusign app (sign in)

Your OAuth app.

This way signs in with an OAuth app you create for Docusign eSignature, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. Sign in to Docusign as an administrator and create an integration: in the Developer Console (https://apps.docusign.com/dev-console/integrations) click + Add, or on the Apps and Keys page of a developer account (https://admindemo.docusign.com/authenticate?goTo=appsAndKeys) click Add App and Integration Key. Name it, for example, Everdeck.
2. Choose Authorization Code Grant. In the User Application section, answer Yes when asked whether your application can securely store a client secret. Add a secret key and copy it (Docusign shows it only once), and add the redirect URI https://everdeck.io/api/oauth/callback.
3. To use a production account, take the integration live. Developer Console: select Submit for Go-Live approval. Apps and Keys: select Actions > Start Go Live and choose the classification Private custom integration. Docusign reviews the integration's recent API calls in the developer environment, and you need administrator access to a paid production account. Secrets and redirect URIs are not copied to production, so add them again on the production side.
4. Copy the integration key (client ID) and secret key into the form, choose the matching environment, then connect and sign in as the Docusign user the agent should send as. You don't need to set up Docusign Connect: live updates from Docusign (starting work when an envelope is completed, declined or voided) aren't available yet, so leave the Connect HMAC key empty.

Field	What to enter
Docusign environment	Choice: Production (account.docusign.com), Developer sandbox (account-d.docusign.com).
API account ID (leave blank to use your default account) (optional)	Text. For example 18b4799a-xxxx-xxxx-xxxx-b5b4b8a97604.
Connect HMAC key (optional, not used yet)	A secret: Everdeck saves it encrypted and never shows it again. Live updates from Docusign Connect aren't available yet; leave this empty.

The scopes Everdeck asks for:

• signature
• extended

Disconnecting deletes the tokens Everdeck saved. Remove Everdeck under Manage Profile > Connected Apps in DocuSign.

JWT grant (no sign-in after one-time consent)

Service account.

1. Create the integration as for the sign-in method (Developer Console or Apps and Keys). Under Authentication, add an RSA key pair and copy the private key (Docusign shows it only once), and add the redirect URI https://everdeck.io/api/oauth/callback.
2. Copy the User ID (a GUID) of the Docusign user the agent should act as. The Apps and Keys page shows the User ID of the person signed in, so a dedicated user such as "AI Employee" can sign in and copy it there.
3. Grant consent once: signed in as that user, open https://account.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://everdeck.io/api/oauth/callback (use account-d.docusign.com for the developer sandbox) and select Accept. An organization with a claimed email domain can instead grant consent for all its users in Docusign Admin > Connected Apps.
4. For a production account, take the integration live as described for the sign-in method. The RSA key pair is not copied to production, so add one on the production side and use that private key.
5. Paste the integration key, user ID and private key into the form and choose the environment. You don't need to set up Docusign Connect: live updates from Docusign aren't available yet, so leave the Connect HMAC key empty.

Field	What to enter
Docusign environment	Choice: Production (account.docusign.com), Developer sandbox (account-d.docusign.com).
Integration key	Text. For example 7c2b8d7e-xxxx-xxxx-xxxx-cda8a50dd73f.
User ID of the Docusign user the agent acts as	Text. For example 564f7988-xxxx-xxxx-xxxx-781ee556ab7a.
RSA private key	A secret: Everdeck saves it encrypted and never shows it again.
API account ID (leave blank to use the user's default account) (optional)	Text. For example 18b4799a-xxxx-xxxx-xxxx-b5b4b8a97604.
Connect HMAC key (optional, not used yet)	A secret: Everdeck saves it encrypted and never shows it again. Live updates from Docusign Connect aren't available yet; leave this empty.

The scopes Everdeck asks for:

• signature
• impersonation

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Docusign eSignature until you delete or rotate it there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Find envelopesTier 0 · ReadReads outside contentdocusign_list_envelopes

  List envelopes whose status changed since a date, optionally filtered by current status, folder or free text. Returns each envelope's id, subject, status, sender and key dates (up to 1,000 per page). Drafts have the status created.

• Read an envelopeTier 0 · ReadReads outside contentdocusign_get_envelope

  Read one envelope with its status, signers and their progress (sent, delivered, signed, declined with reason), documents and custom fields. Docusign allows one status check per envelope every 15 minutes, so do not use this to wait for a signature; signing events arrive as triggers.

• Read filled-in valuesTier 0 · ReadReads outside contentdocusign_get_form_data

  Read the values signers entered or that were pre-filled in an envelope's fields (names, dates, text boxes, checkboxes), overall and per signer. Needs the account's sending setting "Allow sender to download form data".

• Find templatesTier 0 · ReadReads outside contentdocusign_list_templates

  List the account's templates, optionally searching their names. Returns id, name, description, email subject, owner and when each was last used.

• Read a templateTier 0 · ReadReads outside contentdocusign_get_template

  Read a template's roles (the roleName each signer or copy recipient fills), signing order, documents and default email. Call this before create_draft_from_template.

• Draft an envelope from a templateTier 2 · Reversibledocusign_create_draft_from_template

  Create a draft envelope from a template, assigning a person to each role and optionally pre-filling fields. Nobody is emailed until send_envelope is called; the draft appears in the sender's Drafts folder.

• Draft an envelope from a fileTier 2 · ReversibleReads outside contentdocusign_create_draft_from_file

  Create a draft envelope from a PDF or Word file for one or more signers. Signer N signs where the document contains the text /snN/ (for example /sn1/ for the first signer) and the signing date goes where it contains /dsN/. Nobody is emailed until send_envelope is called.

• Send a draft envelopeTier 3 · ExternalReads outside contentdocusign_send_envelope

  Send a draft envelope. Docusign emails the first signers right away; this cannot be undone (only voided).

• Remind signersTier 3 · ExternalReads outside contentdocusign_resend_envelope

  Email the envelope again to the recipients whose turn it is to sign, as a reminder. Works only for envelopes still out for signature.

• Correct a signer's email or nameTier 3 · ExternalReads outside contentdocusign_correct_recipient

  Change a signer's email address or name on a sent envelope, for example after an email bounced, and send it to them again. The email counts as new even if unchanged, so a correction email always goes out. Signers who already signed cannot be changed.

• Void an envelopeTier 4 · Money or irreversibleReads outside contentdocusign_void_envelope

  Cancel an envelope that is out for signature. Recipients are emailed the reason and can no longer sign; this cannot be undone. Completed envelopes and drafts cannot be voided.

• Save the signed PDFTier 0 · ReadReads outside contentdocusign_download_documents

  Download an envelope's documents as one PDF (with the certificate of completion by default), save it to the company's files and return its text. Use it once the envelope is completed.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Docusign eSignature later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Docusign eSignature, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.