omnisign/docusign

DocuSign eSignature for omnisense/omnisign: envelopes signed by e-mail or in the application's page, through the eSignature REST API v2.1, authenticated by the JWT grant - an integration acting as one of the account's users. The gateway calls https://account-d.docusign.com/oauth/token and https://demo.docusign.net/restapi (the demo environment, sandbox: true, the default), or https://account.docusign.com/oauth/token and the account's base URI read from /oauth/userinfo (sandbox: false).

Installation

composer require omnisign/docusign

PHP 8.2 or later, ext-openssl, omnisense/omnisign and symfony/http-client. A DocuSign integration (its key, an RSA key pair whose public half is on the integration), the user it acts as

• who granted it consent once -, and the account's id.

The sources

Read on 2026-10-08: the eSignature REST API v2.1 OpenAPI (docusign/OpenAPI-Specifications, esignature.rest.swagger-v2.1.json, MIT) - envelopes, recipients, recipient views, documents combined and certificate; DocuSign's guides on the JWT grant (account-d.docusign.com / account.docusign.com, grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, claims iss, sub, aud, iat, exp, scope: signature impersonation, RS256) and on Connect's HMAC (X-DocuSign-Signature-1, -2..., base64 HMAC-SHA-256 of the raw body, one per active key).

Credentials

• An integration in DocuSign's admin (Apps and Keys): its integration key, and an RSA key pair whose public half is on the integration (the private half is private_key).
• The user the integration acts as (user_id), who granted it consent once; until then the token is refused with consent_required (InvalidKeyException).
• The API account id (a GUID).
• For webhooks, Connect configured to send JSON with HMAC, and its keys (hmac_keys).

Options

From an envelope to DocuSign's

Only the simple level, and no signer authentication: advanced and qualified signatures, an access code, a phone check are the DocuSign account's settings, not written here - such an envelope is refused.

Capabilities

capabilities(): simple; in the page; ordered; no identity check; third party; documents; no templates. Signer::$phone, $locale and $role are not sent; Document::$signable is not read (every document is sent alike).

Token. A JWT (RS256, iss the integration key, sub the user, aud the account server, an hour's life, scope: signature impersonation) exchanged for an access token, kept until a minute before it lapses. A private key it cannot sign with is an InvalidConfigException.

Example

<?php

require __DIR__.'/vendor/autoload.php';

use Omnisign\Docusign\DocusignGatewayFactory;
use Omnisign\Model\Document;
use Omnisign\Model\Envelope;
use Omnisign\Model\Field;
use Omnisign\Model\File;
use Omnisign\Model\Signer;
use Symfony\Component\HttpClient\HttpClient;

$docusign = (new DocusignGatewayFactory(HttpClient::create()))->create([
    'integration_key' => getenv('DOCUSIGN_INTEGRATION_KEY'),
    'user_id' => getenv('DOCUSIGN_USER_ID'),
    'private_key' => getenv('DOCUSIGN_PRIVATE_KEY'),
    'account_id' => getenv('DOCUSIGN_ACCOUNT_ID'),
]);

$envelope = $docusign->create(new Envelope('Devis 2026-042', [new Document('quote', File::fromPath('quote.pdf'))], [new Signer('client', 'Camille Érable', 'camille@erable.example')], [new Field('client', 'quote', anchor: '/sign/')], embedded: true, redirectUrl: 'https://site.example/quote/42/back'));
$envelope = $docusign->send($envelope);
$url = $docusign->signingUrl($envelope, 'client')->url;   // the recipient view, to use at once

Run on 2026-10-26 on a MockHttpClient serving this package's fixtures (the token, then the envelope; a key pair generated for the run), with the Connect message signed as DocuSign does:

docusign
  > POST https://account-d.docusign.com/oauth/token
  > POST https://demo.docusign.net/restapi/v2.1/accounts/0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d/envelopes
  7c1d2e3f-4a5b-4c6d-8e7f-9a0b1c2d3e4f draft client=1 waiting
  notify: signed recipient-completed 7c1d2e3f-4a5b-4c6d-8e7f-9a0b1c2d3e4f 1 7c1d2e3f-4a5b-4c6d-8e7f-9a0b1c2d3e4f@recipient-completed@1@2026-10-26T09:00:00Z

DocuSign itself was not called. In Symfony:

omnisign:
    gateways:
        quotes:
            factory: docusign
            options:
                integration_key: '%env(DOCUSIGN_INTEGRATION_KEY)%'
                user_id: '%env(DOCUSIGN_USER_ID)%'
                private_key: '%env(DOCUSIGN_PRIVATE_KEY)%'
                account_id: '%env(DOCUSIGN_ACCOUNT_ID)%'
                sandbox: false
                hmac_keys: '%env(default::DOCUSIGN_HMAC_KEYS)%'

Errors

Verified, and not

The package's tests (Tests/DocusignGatewayTest.php, 5 tests) pass on 2026-10-26 (PHP 8.4).

Responsibility

This package is an independent, unofficial client: it is not affiliated with, endorsed by or sponsored by DocuSign, Inc. Whoever runs it complies with DocuSign's Developer Terms and Conditions; see the README's Responsibility section.