# Fix DocuSign "USER_AUTHENTICATION_FAILED" on token refresh

## TL;DR
Line up the integration key, the RSA keypair, and the user identity, then re-grant consent. This error means something in the identity chain does not match: wrong key, revoked consent, or a deactivated user. Check the trio in order and the next token request goes through.

```text
error: USER_AUTHENTICATION_FAILED - the user, integration key, or keypair could not be authenticated
```

1. Verify the RSA keypair matches the integration key. The public key registered on the key's Apps and Keys page must pair with the private key your code signs the JWT with.
   Expected: you confirm the match, or you find the stale key.
2. Check the user named in the JWT claim is active on the account. Deactivated users fail exactly this way.
   Expected: user status shows active.
3. Re-run the consent flow for the integration key. Consent can be revoked, and revocation surfaces as an auth failure.
   Expected: consent granted again for the same key and user.
4. Confirm the key exists in the environment you are calling. A demo key against the production host (or reverse) fails here.
   Expected: the integration key appears on the Apps and Keys page of the targeted environment.

## Use this when
- a working JWT flow starts failing on token requests
- the failure follows a key rotation, user deactivation, or environment switch
- the error names authentication but your code and credentials look unchanged

## Not for this skill when
- the error is consent_required (grant consent first)
- you are using Authorization Code Grant with a refresh token (a different flow)
- the failure is intermittent across many users (check the DocuSign status page for an outage)

## Variant phrasings
- docusign jwt USER_AUTHENTICATION_FAILED token refresh
- docusign user authentication failed service integration
- docusign access token refresh fails after key rotation
- docusign jwt user deactivated authentication error

## Why it happens
The JWT grant authenticates three things at once: the app (integration key), the signature (RSA keypair), and the person (user id in the claim, plus their consent). Any one of them drifting - rotated key, replaced keypair, deactivated user, revoked consent - breaks the whole chain with the same generic error.

## Edge cases
- Clock skew can break the JWT signature window; keep the signing host's clock synced.
- Multiple apps sharing one integration key with different keypairs will intermittently fail.
- The user id in the JWT claim must be the API username (a GUID), not the email, on some setups. Verify which one your account expects.
- After fixing, request a fresh token; do not retry with a cached failed assertion.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jXzWORrOnJPNJp1h-Ba-wA