# docusign oauth consent_required error embedded signing

## TL;DR
consent_required means nobody has granted your integration key the scopes it asks for, most often signature impersonation for the JWT flow. An admin grants organization consent in DocuSign Admin under connected apps, or the individual user completes the consent URL. Retry the token call after consent and it succeeds.

```text
docusign oauth consent_required error embedded signing
```

## Use this when

- DocuSign JWT or Authorization Code flow fails with consent_required
- The integration worked for one user but fails for others
- New scopes were added to the integration key recently

## Not for this skill when

- invalid_client errors (the integration key or secret is wrong)
- Envelope creation or signing failures after a valid token (API problem)
- Redirect URI mismatches at the authorize step (different error)

## Steps

### Step 1: Identify the requested scopes

Check your integration key configuration and the token request for the exact scopes being requested. Expected: you can name the scope that lacks consent, usually signature impersonation.

### Step 2: Grant organization consent

In DocuSign Admin, open Integrations, Connected Apps, and authorize the integration key for the needed scopes across the organization. Expected: the key shows as authorized for those scopes.

### Step 3: Or collect individual consent

If org consent is not appropriate, send the user through the DocuSign consent URL with the required scopes so they grant it personally. Expected: the user completes the consent screen.

### Step 4: Retry the token call

Re-run the JWT assertion or authorization-code exchange exactly as before. Expected: the token endpoint returns an access token instead of consent_required.

### Step 5: Verify the acting user

Confirm the token lets you act as the intended user (check the userinfo response). Expected: the subject matches the expected sender account.

### Step 6: Watch for environment mixups

Confirm consent was granted in the same environment (demo vs production) that the integration calls. Expected: no cross-environment consent gaps.

## Tool compatibility

DocuSign eSignature API; OAuth JWT grant and Authorization Code grant; DocuSign Admin connected apps.

## Variant phrasings

### Variant 1

docusign consent_required jwt impersonation fix

### Variant 2

docusign oauth consent required organization admin grant

### Variant 3

docusign embedded signing consent_required error

## Why it happens

DocuSign treats consent as a first-class security boundary: no application may act on a user's behalf, even with valid credentials, until that user or their admin has explicitly approved the scopes. The JWT grant makes this bite hardest because it is designed for unattended service use, and impersonation is exactly the scope that demands admin-level consent. Teams usually hit this when moving from a developer sandbox, where they clicked through consent once themselves, to production, where no human ever completes the flow. The error is precise about the missing piece, which makes the fix administrative: grant the consent, then the identical code works.

## Edge cases / pitfalls

- Consent granted in the demo environment does not carry to production; each environment needs its own.
- Adding a new scope to the integration key invalidates prior consent for that scope; re-grant after scope changes.
- Individual consent only covers that user; service-wide sending needs organization consent.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nGAs31Cs2qxoAiXfPTK2wg