Integrate Google Workspace with Docusign APIs using JWT Grant authentication

https://account-d.docusign.com/oauth/auth?
  response_type=code&
  scope=signature%20impersonation&
  client_id={YOUR_INTEGRATION_KEY}&
  redirect_uri={A_REGISTERED_REDIRECT_URI}

var navigator = {}; // Fake a navigator object for the jsrsasign lib
var window = {};    // Fake a window object for the jsrsasign lib

// Importing : https://github.com/kjur/jsrsasign/blob/master/jsrsasign-all-min.js
eval(UrlFetchApp.fetch('https://raw.githubusercontent.com/kjur/jsrsasign/refs/heads/master/jsrsasign-all-min.js').getContentText());

/**
 * Generates a signed JSON Web Token (JWT) required for Docusign JWT Grant.
 * @return {string} The signed JWT.
 */
function generateDocusignJWT() {
  // Docusign configuration parameters
  const CLIENT_ID = "YOUR_INTEGRATION_KEY";        // Docusign integration key
  const USER_ID = "YOUR_USER_ID";                  // Docusign user ID (GUID)
  const AUTH_SERVER = "account-d.docusign.com";   // Use "account-d.docusign.com" for the developer environment, "account.docusign.com" for production
  
  // NOTE: Private key MUST be formatted as a single-line string with escaped newlines.
  const PRIVATE_KEY = `-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQ...
...
-----END RSA PRIVATE KEY-----`; 

  // JWT timing (standard practice)
  const iat = Math.floor(Date.now() / 1000); // Current timestamp in seconds (Issued At)
  const exp = iat + 3600; // Expiration in 1 hour

  // 1. JWT header
  const header = {
    alg: "RS256", 
    typ: "JWT"
  };

  // 2. JWT payload
  const payload = {
    iss: CLIENT_ID,   // Integration key
    sub: USER_ID,     // User ID being impersonated
    aud: AUTH_SERVER, // Authentication server
    iat: iat, // Issued At claim identifies the time of issuance in epoch time 
    exp: exp, // Expiration time for the JWT assertion when assertion should not be accepted anymore for processing
    scope: "signature impersonation" // List of possible scopes is available from https://developers.docusign.com/platform/auth/reference/scopes/ 
  };

  // 3. Signing the JWT using jsrsasign
  var sHeader = JSON.stringify(header);
  var sPayload = JSON.stringify(payload);
  
  // https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.sign 
  var signedJWT = KJUR.jws.JWS.sign("RS256", sHeader, sPayload, PRIVATE_KEY);

  console.log("sJWT: "+ signedJWT);
  return signedJWT;
}

/**
 * Retrieves a Docusign access token using the generated JWT.
 * @return {string} The Docusign access token.
 */
function getDocusignAccessToken() {
  const jwt = generateDocusignJWT();
  
  const url = "https://account-d.docusign.com/oauth/token"; 
  
  const options = {
    method: "POST",
    contentType: "application/x-www-form-urlencoded", 
    payload: {
      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
      assertion: jwt 
    }
  };

  // UrlFetchApp handles the HTTP POST request
  const response = UrlFetchApp.fetch(url, options);
  const json = JSON.parse(response.getContentText());

  if (json.error) {
    Logger.log("Error: " + json.error + " - " + json.error_description);
    throw new Error("Docusign Token Error: " + json.error_description);
  }
  
  return json.access_token;
}

/**
 * Retrieves Docusign userinfo and extracts the base path required for API calls.
 * * @return {object} An object containing the accountId, baseUri, and accessToken.
 */
function getDocusignUserInfoAndBasePath() {
  const token = getDocusignAccessToken();
  
  const USERINFO_URL = "https://account-d.docusign.com/oauth/userinfo"; 
  
  const options = {
    method: "GET",
    headers: {
      "Authorization": "Bearer " + token 
    },
    muteHttpExceptions: true
  };
  
  try {
    const response = UrlFetchApp.fetch(USERINFO_URL, options);
    const responseCode = response.getResponseCode();
    const responseText = response.getContentText();
    
    if (responseCode !== 200) {
      Logger.log("Response Text: " + responseText);
      throw new Error("Failed to retrieve Docusign UserInfo.");
    }
    
    const userInfo = JSON.parse(responseText);
    
    // Check if the accounts array exists and is not empty 
    if (!userInfo.accounts || userInfo.accounts.length === 0) {
        throw new Error("User is authenticated but has no active Docusign accounts linked.");
    }

    // Find the default account for API calls
    const defaultAccount = userInfo.accounts.find(account => account.is_default);

    if (!defaultAccount) {
        throw new Error("User has no default Docusign account.");
    }
    
    // The base URI must include the /restapi/v2.1 segment
    const baseUri = defaultAccount.base_uri + "/restapi/v2.1";
    
    Logger.log("Docusign Connection Successful!");
    Logger.log("Base API URI: " + baseUri);
    
    return {
      accountId: defaultAccount.account_id,
      baseUri: baseUri,
      accessToken: token // Useful to return the token alongside the URIs
    };

  } catch(e) {
    Logger.log("API Call Failed: " + e.message);
    throw e;
  }
}

// Final test function: Call this function to start your Docusign integration 
function startDocusignAutomation() {
  const credentials = getDocusignUserInfoAndBasePath();
  // Now you can use credentials.baseUri, credentials.accountId and credentials.accessToken
  // to build your requests (e.g., sending an envelope).
  Logger.log("Ready to make API calls using Account ID: " + credentials.accountId);
}