DocuSign / Ruby - unsupported_grant_type when trying to obtain token

Question

We are moving away from using the DocuSign::Esign gem and we are trying to make the API calls following the How to get an access token with JWT Grant authentication instructions. The consent has already been granted for this application when we set up this originally with the DocuSign::Esign gem.

I am getting the following error:

{"error"=>"invalid_grant", "error_description"=>"unsupported_grant_type"}

I am using Ruby and am running this code in the console

config = Padrino.config.docusign
current_time = Time.now.utc

header = { 
  typ: 'JWT', 
  alg: 'RS256'
}

body = {
  iss: config.integrator_key,
  sub: config.user_id,
  iat: current_time.to_i,
  exp: (current_time + 1.hour).to_i,
  aud: config.host,
  scope: 'signature impersonation'
}

key_file = "-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAiOMDM5jdGYTEOC/nFVUTQ3+5U2TCUpEKyUD+mByldDbgvT9q
. . .
jDjfX6L15x8JcY9eiXvCvZNF6Za2dg8cagK+ff5d6KLodmVFD5o=
-----END RSA PRIVATE KEY-----"
private_key = OpenSSL::PKey::RSA.new(key_file)

token = JWT.encode(body, private_key, 'RS256')

uri = 'https://account-d.docusign.com/oauth/token'
data = {
  grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
  assertion: token 
}
auth_headers = {content_type: 'application/x-www-form-urlencoded'}

However, when I call the api, I get a RestClient::Bad response error

irb(main):352:0> begin
irb(main):353:1>   RestClient.post(uri, data.to_json, auth_headers)
irb(main):354:1> rescue RestClient::BadRequest => e
irb(main):355:1>   JSON.parse(e.http_body)
irb(main):356:1> end
=> {"error"=>"invalid_grant", "error_description"=>"unsupported_grant_type"}

I am not sure what I am doing wrong. The JWT decodes correctly when I check it in https://jwt.io/ . I am using the grant_type exactly as provided in the documentation.

Answer 1

Hmmm,

1. scope claim only needs to be signature ( impersonation is implied since you're using the JWT grant flow.)
2. For the aud claim, what is config.host ? It should be account-d.docusign.com for the developer system (Do not include https:// )
3. Your main error is that you are sending the data hash in JSON format. That's wrong, it must be sent in url form format. Try

RestClient.post(uri, data, auth_headers)

instead. (Don't convert the data to json.)