DocuSign API调用返回401未授权错误排查求助

我尝试获取特定DocuSign账户下某用户的所有模板列表，流程如下：

1. 通过get_token()函数用JWT获取应用访问令牌：

def get_token():
    DS_JWT = {
        "ds_client_id": "79b1adb9-xxxx-xxxx-xxxx-4450dd98a712",
        "ds_impersonated_user_id": "3300d1d8-xxxx-xxxx-xxxx-552b87311b0f",
        "private_key_file": "private.key",
        "authorization_server": "account-d.docusign.com"
    }

    private_key = get_private_key(DS_JWT["private_key_file"]).encode("ascii").decode("utf-8")
    api_client = ApiClient()
    ds_app = api_client.request_jwt_application_token(
        client_id=DS_JWT["ds_client_id"],
        oauth_host_name=DS_JWT["authorization_server"],
        private_key_bytes=private_key,
        expires_in=3600,
        scopes=["signature", "impersonation"]
    )

    return ds_app.access_token

2. 获取令牌后调用list_templates()函数获取模板列表：

def list_templates(token: str):
    get_params = {'search_text': 'Test_3'}
    get_headers = {'Authorization': token}
    get_r = requests.get(url="https://demo.docusign.net/restapi/v2.1/accounts/b24dee2d-xxxx-xxxx-xxxx-d9d81de867ab/templates", params=get_params, headers=get_headers)
    get_r.raise_for_status()
    data = get_r.json()
    data_templates = data['envelopeTemplates']
    list_templates = []

    for inner_data in data_templates:
        for relevant_data_key, relevant_data_value in inner_data.items():
            if relevant_data_key == 'name':
                list_templates.append(relevant_data_value)

    return list_templates

def main():
    load_dotenv(dotenv_path=".env", override=True, verbose=True)

    token = get_token()
    print(token)
    templates = list_templates(token=token)
    print(templates)

if __name__ == '__main__':
    main()

问题现象 #

使用手动获取的令牌传入list_templates()可正常获取模板列表，但用get_token()生成的令牌时，出现401未授权错误：

Traceback (most recent call last):
  File "src/docusign_template_app/obtain_token_4.py", line 57, in <module>
    main()
  File "src/docusign_template_app/obtain_token_4.py", line 52, in main
    templates = list_templates(token=token)
  File "src/docusign_template_app/obtain_token_4.py", line 35, in list_templates
    get_r.raise_for_status()
  File "/home/lluis/.pyenv/versions/docusign-template-app_py38/lib/python3.8/site-packages/requests/models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://demo.docusign.net/restapi/v2.1/accounts/b24dee2d-xxxx-xxxx-xxxx-d9d81de867ab/templates?search_text=Test_3

解决建议 #

• 修正Authorization头格式：JWT令牌需要添加Bearer 前缀，将get_headers = {'Authorization': token}修改为get_headers = {'Authorization': f'Bearer {token}'}。手动获取的令牌通常已包含该前缀，而JWT接口返回的是纯令牌字符串，缺少前缀会导致身份验证失败。
• 验证JWT令牌的权限与有效性：使用JWT解析工具查看令牌的scopes字段，确认包含signature和impersonation；同时检查aud字段是否指向Demo环境（account-d.docusign.com），确保环境一致。
• 确认账户与用户的关联关系：验证API调用中使用的账户ID（b24dee2d-xxxx-xxxx-xxxx-d9d81de867ab）是ds_impersonated_user_id对应的用户所属的DocuSign账户，且该用户在该账户中拥有模板访问权限。
• 检查私钥与应用的匹配性：确认private.key中的私钥与DocuSign控制台中对应应用（ds_client_id）上传的公钥完全匹配，私钥不匹配会生成无效令牌。

内容的提问来源于stack exchange，提问作者Lous