CODEWITHSUNDEEP
docusignapi
Fred
Fred

Reputation: 389

Some of our clients getting PARTNER_AUTHENTICATION_FAILED

Most of our clients are having no issues whatever with our system. We have an integrator key and our users do an initial link up for integration using OAuth on REST. We store the access/refresh tokens. Works fine. At some point down the road some clients seem to randomly hit this.

We are using OAuth with the REST API and always get a new access token using the client's refresh token if their access token is within 30 minutes of expiring.

Q: If a client's access token expires before they make a subsequent call (some of our clients might go 30 days before having another document to sign) to get a new one with the refresh token can that cause this?

Q: Can the refresh token expire such that they would get this?

Q: Short of the client manually revoking access to the integration on their DocuSign account, what else could cause this?

Upvotes: 0

Views: 206

Answers (1)

Larry K
Larry K

Reputation: 49114

If you get this error then you need to restart the oauth flow again.

A refresh token does expire at some point. When it expires is a policy issue. To achieve the longest possible refresh token lifetime, request scope extended in addition to signature.

Re: Q: If a client's access token expires before they make a subsequent call (some of our clients might go 30 days before having another document to sign) to get a new one with the refresh token can that cause this?

A: I'm surprised that you're getting this specific error, but I haven't tried this for awhile. I'd think the error would have a different name.

Q: Can the refresh token expire such that they would get this?

A: Same answer as above re the specific error name. In any case, a refresh token can definitely expire. Requesting the extended scope should minimize this, but at some point an account may set a policy that will also expire extended scope refresh tokens. Bottom line: your app needs to be prepared to ask the user to go through the entire OAuth Auth Code Grant flow again.

Q: Short of the client manually revoking access to the integration on their DocuSign account, what else could cause this?

A: Using the wrong base url for the user. Also, at some point there will be organizational controls that can force policies upon the org's accounts. (Organizations own and control accounts.)

Upvotes: 3

Related Questions