DocuSign

Connect your DocuSign account to Ploy to automatically sync users, their permission profiles, and groups, so you can manage and review access to DocuSign alongside the rest of your stack.

Before you begin: You'll need admin access to your DocuSign account. Ploy connects using a DocuSign integration app (JWT Grant) that impersonates an API user — use an admin user so Ploy can read the account's full user list. If you're using a DocuSign developer (demo) account, select the Demo environment in Ploy; for a live account, select Production.

Create an integration app in DocuSign

Log in to DocuSign as an admin and open Settings.
Navigate to Integrations > Apps and Keys.
Note the User ID shown at the top of the page — this is the API Username GUID of the user Ploy will impersonate.
Click Add App and Integration Key, name the app "Ploy" and create it.
Copy the Integration Key (a GUID) — you'll enter it in Ploy.

Connect DocuSign to Ploy

In Ploy, add the DocuSign integration and enter the credentials from DocuSign.

In Ploy, click Integrations in the left sidebar.
In the main Integrations tab, click Add new integration and search for DocuSign.
Choose your Environment — Demo for a DocuSign developer account, Production for a live account.
Enter the Integration Key from Apps and Keys.
Enter the API Username (User ID) — the User ID GUID of the user Ploy will impersonate.
Save — Ploy generates an RSA public key for you to upload to DocuSign in the next step.

Upload the RSA public key to DocuSign and grant consent so Ploy can impersonate the API user.

Copy the public key Ploy generated.
Back in DocuSign Apps and Keys, open the integration key you created.
Under Service Integration, click Add RSA Keypair, then Upload RSA, and paste the public key.
Under Additional settings, add the Redirect URI shown in Ploy (it must match exactly, or granting consent will fail).
Save your changes in DocuSign.
In Ploy, click the Grant consent link, sign in as the API user and click Accept — this one-time consent allows Ploy to impersonate the API user.
Back in Ploy, click Test Connection to verify the connection and finish the setup.

What data syncs

Ploy imports the following from DocuSign:

Users: every user in your DocuSign account, with their name, email, status, permission profile, and admin flag.
DocuSign access: each user's access to DocuSign, with their permission profile as the entitlement.
Groups: DocuSign groups and each user's group memberships.

Data syncs periodically to keep Ploy's access graph up to date.

Permissions and security

This section sets out exactly what access Ploy is granted, so it can be shared with your security, change-control, or audit teams.

OAuth scopes

At the consent step, Ploy requests exactly two DocuSign OAuth scopes — no others:

signature — access the DocuSign eSignature API as the impersonated user
impersonation — allows Ploy to act on behalf of the nominated API user via JWT Grant, without an interactive login

How the connection is secured

Ploy authenticates with DocuSign's JWT Grant flow, impersonating the single API user you nominate. No DocuSign password is shared.
Ploy generates an RSA key pair: you upload only the public key to DocuSign, and the private key never leaves Ploy.
Access is granted through a one-time consent you approve as the API user, and you can revoke it at any time from DocuSign.

The integration is read-only

Ploy makes no create, update, or delete calls to DocuSign — it only reads users, permission profiles, and groups. If a reviewer revokes DocuSign access during an access review, Ploy raises it as a manual task for a person to action in DocuSign; nothing is written back automatically.

What is not included

Ploy does not send, void, or read envelopes or documents, does not read document content, and does not change DocuSign settings or user accounts. Reads are limited to the account of the impersonated API user.

Was this helpful?