授权代码授予：当用户不在时如何获取访问令牌？

Question

I would like to ask the user to authorize my application only once and then be able to use his credentials to make DocuSign API call even when he is not connected to perform automatic operations.

I am currently using Authorization Code Grant but how can i do to never ask the user to authorize my application again ?

Answer 1

An excellent question. Here's an answer:

1. When using authorization code grant with the user, include scope extended in addition to scope signature
2. After the user authenticates and grants consent, your app will receive an access token (good for 8 hours) and a refresh token (good for 30 days).
3. Then when your app needs to use the DocuSign API, use the access token (whether the user is present or not). If it doesn't work then use the Refresh Operation to obtain a new access token (good for 8 hours) and a new refresh token (good for 30 days from the time of the refresh operation)

Result: Your app will always be able to use either its current access token for the user to do operations on behalf of the user, or will be able to get a new access token for use.

Caveat: Your app will need to use the refresh operation at least once every 30 days otherwise the refresh token will expire. In that case, the user will need to re-authenticate via your app and the Authorization Code Grant flow.

Corner cases: Since the user can withdraw consent at any time, your app should gracefully handled that case.

Note Since the refresh token lasts 30 days, you'll want to store it in durable storage (eg a DBMS), not just in memory.