Secure DocuSign access for AI agents

Through DocuSign, agents can query envelopes and Navigator agreements, and send envelopes or trigger Maestro workflows when you allow it – every call runs through your policies and is logged for audit.

Server URL: https://mcp.docusign.com/mcp

Credential modes

DocuSign supports bring your own app only. It does not support dynamic client registration, and Integration Keys are tied to a customer account, so your organization registers its own Integration Key and supplies the client ID and secret. See Credential modes for how the modes compare.

Before you begin

• A DocuSign developer account that can create apps, at admindemo.docusign.com. DocuSign does not allow apps to be created directly in production accounts.
• A DocuSign account entitled to all seven scopes listed under Required scopes.
• Administrator access to your Agent Authority workspace, to add the resource.

Setup moves between two consoles, and includes a DocuSign review that takes several business days. You copy a redirect URI in the Agent Authority console, register an Integration Key in DocuSign, promote it through DocuSign's Go-Live process, then return to the console and paste the credentials.

Setup

1. Copy the redirect URI

In the Agent Authority console, go to Resources → Add Resource and select DocuSign. DocuSign is bring-your-own-app only, so the credentials form opens as soon as you select it, with no mode to pick.

Copy the Redirect URI shown on the form. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.

Leave this page open. You come back to it in step 4.

2. Register an Integration Key in DocuSign

An Integration Key is DocuSign's term for an OAuth client. In your DocuSign developer account at admindemo.docusign.com, open Settings → Apps and Keys and click Add App / Integration Key.

Configure the app:

• Under Authentication, enable the Authorization Code Grant flow, add a Secret Key, and copy it. This is your Client Secret.
• Under Redirect URIs, paste the Redirect URI from the form in the Agent Authority console, using the Copy button next to it.
• Under Scopes, enable every scope listed under Required scopes.

Save the app, then copy the Integration Key UUID at the top. This is your Client ID.

3. Promote the app through Go-Live

From the app's settings, follow DocuSign's Go-Live promote process. DocuSign reviews and approves the app, typically over several business days. Once approved, the same Integration Key works against your production DocuSign account.

4. Finish in the console

Back on the DocuSign form in the Agent Authority console, paste the Integration Key UUID into Client ID and the Secret Key into Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.

The gateway sends you to DocuSign to sign in, through your SSO if configured, and authorize the app. Review the requested access and click Allow. You return to the console with your DocuSign account connected.

Verify the connection

The gateway syncs the DocuSign tools automatically. To check the connection end to end, ask your agent to run a request:

Get my DocuSign user info

If your DocuSign account and user details come back, the connection is working.

How users connect

Access is per user. Each additional user connects their own DocuSign account the first time their agent calls a DocuSign tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.

DocuSign's own account permissions control what each user can reach. The gateway does not widen access beyond what the authenticated user could already do in DocuSign.

Available tools

Required scopes

Enable all seven in the app's Scopes section. The gateway requests exactly this list and the scopes come from the catalog entry, so there is nothing to edit on the DocuSign resource page.

• signature – eSignature envelopes, templates, brands, recipients, and users
• aow_manage – Maestro workflows: trigger, list, pause, resume, and cancel
• adm_store_unified_repo_read – Navigator agreement queries
• agreement_object_model_read – the full agreement schema in getAgreementDetails
• models_read – the searchDocusignDocs and suggestBestPractices tools
• me_profile – the authenticated user's profile, via getUserInfo
• extended – keeps refresh tokens valid beyond the default 30-day window

Policy examples

Rules are evaluated first-match-wins from the top of the list, and every org starts with a seeded Allow all rule sitting at the bottom – so a recipe made only of allow rules restricts nothing. These examples work by adding denies above it.

• Read-only access: deny the write surface – createEnvelope, updateEnvelope, triggerWorkflow, cancelWorkflowInstance, pauseNewWorkflowInstances, resumeWorkflow, installDVApps, cloneDVEnabledTemplates, and generateAccessToken. The rest of the surface is queries and analysis.
• Block envelope sending and modification: deny createEnvelope, updateEnvelope
• Block workflow control but allow inspection: deny triggerWorkflow, cancelWorkflowInstance, pauseNewWorkflowInstances, resumeWorkflow – the get* workflow tools stay available
• Restrict admin tooling: deny installDVApps, cloneDVEnabledTemplates, generateAccessToken

To deny by default instead, delete or disable the seeded Allow all rule and allow the read surface explicitly: get*, list*, search*, assessTemplatesForDV, discoverDVApps, planTemplateDataVerification, and suggestBestPractices. Removing Allow all is org-wide: anything relying on that fall-through loses access, so add your specific rules first.

Next steps

• Create a policy – start from the read-only pattern in Policy examples above.
• Connections – manage the DocuSign accounts your users have linked.