3 ms·

Maybe the goal here wasn't to be technical (although I'm not sure why given it's an article about docusign api integration) but this is a WHOOOOOLE lot of text

Maybe the goal here wasn't to be technical (although I'm not sure why given it's an article about docusign api integration) but this is a WHOOOOOLE lot of text with basically nothing worth reading. >I was annoyed that they didn’t provide a secret key to authorize API requests Yeah... they don't do that for a reason. They appear to support a fully fledged OAuth implementation (https://developers.docusign.com/esign-rest-api/guides/ https://developers.docusign.com/esign-rest-api/guides/). I haven't used it, so maybe it's terrible, but I'm suspicious of the author at this point. >DocuSign API docs are very quirky But no discussion of why, or what he would expect instead. This actually sounds like the author is lost because they don't understand OAuth again (and to be fair, I've implemented OAuth and it's easy to get wrong). >Someone on the team noticed that if you refresh the page, you get logged in as the user that was making the API request. [...] About a week later, we were informed that this is intentional, and they were worried about breaking anyone that is using this as a feature. This honestly sounds like they were politely telling you that you haven't implemented OAuth correctly. You should be making the request with the token of the delegated user, not a generic account. >I got this working, but it took some janky work to re-work the JWT flow to manage hourly expiring tokens for all of our user that choose to enable the esignature feature. This is what refresh tokens are for. I highly doubt the refresh token expired in an hour, but hey - I haven't used it so maybe I'm wrong. --- I honestly believe I can summarize this whole article as: Dev takes first steps into OAuth and gets lost...

fyjvd90 8y ago
OAuth is going to be hard to use if you don’t create an account though, there’s no way for DS to know what scopes to restrict the user to, it sounds like that was the core issue that broke their workflow.
- sunir 8y ago
  I think it is very unclear what is real and not real. OP is mostly passing blame to DocuSign without achieving full understanding themselves. That is more an indictment on OP than DocuSign even if there is some actual session security problem with DocuSign (likely from the deprecated API).
  - stingraycharles 8y ago
    Yeah and it sounds like they were trying to do something that makes no sense for DocuSign to support: use a single account to sign all users’ documents. DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? They support oauth and that makes sense and should be the way to do it.
    - treis 8y ago
      >DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? By the signature. I don't know how it works in DocuSign's internals, but there's no requirement for the signer to have an account. The point of the account is for users to see all of their documents in one place. In OP's case that's everyone's documents because they use a single account. https://support.docusign.com/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing https://support.docusign.com/articles/How-do-I-sign-a-DocuSi...
      - lowercased 8y ago
        Yep. I just signed things via docusign 2 weeks ago. There was no 'create an account' first. IIRC, there was something at the end indicating I could create an account after the doc was signed, but I got a copy via email anyway which was all I needed. The last thing I need is yet another account/login for what is essentially a one-time thing.
    - nulagrithom 8y ago
      DocuSign should've recognized this and let them know the flaws in their plan, but in my experience they're _way_ too sales-oriented to ever do this. I had a similar experience. I explored their API and got stuck on how to implement my use-case and how to ensure it's legally binding. Sales and "technical" resources assured me it was possible, didn't explain how, and everyone balked at any sort of legal questions and basically told me that was all on us to sort out. I decided I didn't need help creating a box for users to scribble on. E-signature isn't a technical challenge at all.

fyjvd90 8y ago

OAuth is going to be hard to use if you don’t create an account though, there’s no way for DS to know what scopes to restrict the user to, it sounds like that was the core issue that broke their workflow.

sunir 8y ago
I think it is very unclear what is real and not real. OP is mostly passing blame to DocuSign without achieving full understanding themselves. That is more an indictment on OP than DocuSign even if there is some actual session security problem with DocuSign (likely from the deprecated API).
- stingraycharles 8y ago
  Yeah and it sounds like they were trying to do something that makes no sense for DocuSign to support: use a single account to sign all users’ documents. DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? They support oauth and that makes sense and should be the way to do it.
  - treis 8y ago
    >DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? By the signature. I don't know how it works in DocuSign's internals, but there's no requirement for the signer to have an account. The point of the account is for users to see all of their documents in one place. In OP's case that's everyone's documents because they use a single account. https://support.docusign.com/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing https://support.docusign.com/articles/How-do-I-sign-a-DocuSi...
    - lowercased 8y ago
      Yep. I just signed things via docusign 2 weeks ago. There was no 'create an account' first. IIRC, there was something at the end indicating I could create an account after the doc was signed, but I got a copy via email anyway which was all I needed. The last thing I need is yet another account/login for what is essentially a one-time thing.
  - nulagrithom 8y ago
    DocuSign should've recognized this and let them know the flaws in their plan, but in my experience they're _way_ too sales-oriented to ever do this. I had a similar experience. I explored their API and got stuck on how to implement my use-case and how to ensure it's legally binding. Sales and "technical" resources assured me it was possible, didn't explain how, and everyone balked at any sort of legal questions and basically told me that was all on us to sort out. I decided I didn't need help creating a box for users to scribble on. E-signature isn't a technical challenge at all.