Options for integrating DocuSign into an SPA

Question

I'm working on a submission for a conference. I'd like to integrate DocuSign with Alfresco's Angular based developer framework and specifically the Alfresco Content App.

In order to keep things simple, I'd like to think about workflows that could be done 100% from the browser without any backend code of my own.

I suspect I could create a "Sign this document now" type action for any document found in the Alfresco UI. That could initiate an OAuth flow that would not require any backend services of my own.

I think I would need to put my integrator key into the SPA. This would then be visible to anyone using the app. From reading through docs, I'm unclear if it is OK to "leak" this key?

Are there other use cases I can implement in an SPA without adding backend services of my own? Things like, sending a doc out to be signed by one or more people? Or embedding a signing experience in the Angular UI?

I have seen the following series on the DocuSign blog:

https://www.docusign.com/blog/dsdev-building-single-page-applications-with-docusign-and-cors-part-1/

Having read through that and also the REST API documentation, I'm still unclear if it is even possible to implement something like this without any support from my own backend service.

I also have not found any place online where I can reach out to a developer evangelist from DocuSign to discuss my options. I believe DocuSign developers monitor SO, so figured this was the next best thing.

Answer 1

Great question. Browsers implement the Same Origin Policy. So, as I wrote in the blog series (see all three of my posts listed below), you will need a CORS gateway to make API calls from your Angular program running in the browser itself to the DocuSign system.

The good news is that creating a private CORS gateway isn't hard. See part 2 of the series:

• Part 1. Introduction
• Part 2. Building a private CORS gateway
• Part 3. An example React SPA

Authentication

Your app will need an access token when it makes API calls to DocuSign. There are multiple techniques available to give your app the access token it needs:

• Your app can, by itself, authenticate the user with DocuSign. In this case, because of the security issues--as you mentioned in your question--you do not use the OAuth Authorization Code Grant flow. Instead, you use the OAuth Implict Grant flow, which is designed for this use case. This flow is demonstrated in part 3 of the blog series.
• You can implement the OAuth Authorization Code Grant flow in your server, and then create a private API between your server and your browser app to obtain the access token.

A private API

As an alternative to using CORS, you can just implement your own private versions of the DocuSign API methods on your server. Then your browser app would send a private_send_envelope request to your server. Your server would manage the access token, send the request to DocuSign, and relay the response back to your browser app.

This pattern is the same as your question about implementing a backend service. It will work fine but is not as elegant as implementing everything within your browser app. Depending on your immediate and future API needs by your SPA, this might be a good idea or not.

CORS support is the key

Until DocuSign has CORS support you'll need to build something on the backend. Either a CORS gateway (which only involves configuration, not software) or a private API gateway.

Please ask your DocuSign sales or technical contact to add your information to the internal DocuSign proposal for CORS support, PORTFOLIO-1100. This will help raise the priority of CORS support. Thanks.

Specific answers

Regarding:

I think I would need to put my integrator key into the SPA. This would then be visible to anyone using the app. From reading through docs, I'm unclear if it is OK to "leak" this key?

Answer: It is okay to add your integrator key (IK) to your browser app if and only if the IK is set for Implicit Grant usage (check the "Mobile App" checkbox on the IK's property sheet).

Having read through that and also the REST API documentation, I'm still unclear if it is even possible to implement something like this without any support from my own backend service.

Answer: at this time you will either need to implement a private CORS gateway or implement backend software.