Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from Failed DocuSign Integration

profsmallpine.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Lessons from Failed DocuSign Integration

#71

Post by lowercased »

sunir wrote: post #40
inoda wrote: post #14

I was on this project and can speak a bit more on the technical details here. A couple of high level goals: 1. We wanted to use their embedded flows, to keep the experience within our application as much as possible. 2. We wanted to avoid having to create a DS user for every user in our application that turned on this feature. We were looking for using 1 “API user” to make requests, handling data scoping ourselves wi…

It’s an esignature application. Of course by law you have to create a Docusign user for each record holder. You may come and go bankrupt but your customers have to hold their own contracts on file for the life of the contract plus N years depending on their jurisdiction (eg 7 years).

Law citation please? To be more clear, I've just signed documents via docusign and did not have to create an account. Perhaps the system behind me did something to create an account for my email address without my consent, but I don't have a 'docusign account' in any meaningful sense.

Re: Lessons from Failed DocuSign Integration

#72

Post by lowercased »

treis wrote: post #51
stingraycharles wrote: post #47

Earlier quoted context omitted.

Yeah and it sounds like they were trying to do something that makes no sense for DocuSign to support: use a single account to sign all users’ documents. DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? They support oauth and that makes sense and should be the way to do it.

>DocuSign has a legal obligation here to prove authenticity, how are they ever going to be able to do that if everything is behind a single account? By the signature. I don't know how it works in DocuSign's internals, but there's no requirement for the signer to have an account. The point of the account is for users to see all of their documents in one place. In OP's case that's everyone's documents because they use…

Yep. I just signed things via docusign 2 weeks ago. There was no 'create an account' first. IIRC, there was something at the end indicating I could create an account after the doc was signed, but I got a copy via email anyway which was all I needed. The last thing I need is yet another account/login for what is essentially a one-time thing.

Re: Lessons from Failed DocuSign Integration

#73

Post by treis »

larrykluger wrote: post #66

I am DocuSign’s Lead Developer Evangelist. Thanks to Joseph (OP) for writing this up and to everyone who has contributed to this thread including both the positive and negative comments about integrating with DocuSign. The problem OP ran into is really one of documentation and not a bug or security issue. I agree that our docs for the embedded sender view should clearly state that the method’s URL gives full access t…

>The problem OP ran into is really one of documentation and not a bug or security issue.

I'm confused about this. If I am given a link for a DocuSign I can gain access to the sender's account by refreshing the page?

Re: Lessons from Failed DocuSign Integration

#74

Post by [deleted] »

lowercased wrote: post #71
sunir wrote: post #40

Earlier quoted context omitted.

It’s an esignature application. Of course by law you have to create a Docusign user for each record holder. You may come and go bankrupt but your customers have to hold their own contracts on file for the life of the contract plus N years depending on their jurisdiction (eg 7 years).

Law citation please? To be more clear, I've just signed documents via docusign and did not have to create an account. Perhaps the system behind me did something to create an account for my email address without my consent, but I don't have a 'docusign account' in any meaningful sense.

[deleted]

Re: Lessons from Failed DocuSign Integration

#75

Post by jessaustin »

larrykluger wrote: post #66

I am DocuSign’s Lead Developer Evangelist. Thanks to Joseph (OP) for writing this up and to everyone who has contributed to this thread including both the positive and negative comments about integrating with DocuSign. The problem OP ran into is really one of documentation and not a bug or security issue. I agree that our docs for the embedded sender view should clearly state that the method’s URL gives full access t…

I also agree that the OP’s use case, which requires that the sender view’s capabilities be strictly limited to the current envelope, is valid. It is under consideration for our roadmap.

If this case is valid, other customers besides OP are doing the same thing. They probably have the same vulnerability. It's also not clear how document tagging can stop this hole. If there is just one user then that user's users can't have that user's creds. Rather they must be limited to specific tokens that give them access to their specific documents.

Re: Lessons from Failed DocuSign Integration

#76

Post by jessaustin »

jrm2k6 wrote: post #23

Advice: Skip straight to the situation paragraph as anything before that isn't about the DocuSign integration, not sure what the first section brings to the whole article.

This is the third entry in the blog. Author just had some stuff to get off his chest. He might want to split this into two entries...

Re: Lessons from Failed DocuSign Integration

#78

Post by PostOnce »

kodon wrote: post #35

I had a project that used docuSign a few years ago. There were some very strange things going on with their API. I remember having to call them asking where to find a template ID so I could save that and send out the proper doc to customers. It was not listed anywhere on the developer dashboard. The rep told me in a very condescending way that it template ID was part of the URL. I should have known to just use that!…

I also worked on a Python project that integrated DocuSign.

I was able to hack together solutions and skirt around DocuSign's many problems, garbage documentation, and general very-low-quality API, but in no circumstance would I ever recommend it to anyone. Late in the project I seriously considered throwing it away and switching to another API.

The other API I considered was: https://app.hellosign.com/api/pricing

This is literally ten times the price of DocuSign and I don't know how long they'll be in business, so it's a hard sell to buy into that. The API docs looked way way better (like stripe or twilio or slack apis, rather than some janky enterprise nonsense), but development and hacking around DocuSign was a one time expense, and the API is an ongoing cost.

If remotely possible, I'd just sign stuff in person and mail or fax it, since all this stuff just adds difficulty, complexity, and cost, to very little benefit unless you have a LOT of people signing stuff. The application I worked one was for one or two signatures a month, so not worth the trouble.

Re: Lessons from Failed DocuSign Integration

#79

Post by cagmz »

f0rgot wrote: post #67
rblatz wrote: post #26

Earlier quoted context omitted.

I just checked we are using the v2 rest api. We create a user, we do not send them an email, we then add the documents and setup the envelope, then direct them to the user's embed signing room. I wish I could find the old postman POC since that would make it a lot easier for me to explain exactly our sequence of api calls.

We use v2 API as well and like rblatz said, we haven't ran into any problems. Our backend signs in to DocuSign as the main account. When a particular event requires it, the backend sends a POST to DocuSign and creates an envelope. In this POST request, we tell DocuSign that the user is going to be an embedded user. Once the envelope is created, we can ask for the "view url". In this request, we not only tell DocuSign…

This is exactly how our integration works, as well.

Re: Lessons from Failed DocuSign Integration

#80

Post by charlie0 »

inoda wrote: post #60
inoda wrote: post #14

I was on this project and can speak a bit more on the technical details here. A couple of high level goals: 1. We wanted to use their embedded flows, to keep the experience within our application as much as possible. 2. We wanted to avoid having to create a DS user for every user in our application that turned on this feature. We were looking for using 1 “API user” to make requests, handling data scoping ourselves wi…

I'd like to add a little more to this - our main frustration isn't necessarily because of these technical difficulties. Communicating implementation details and 3rd party integrations can be challenging, especially if one side of the convo is not super technical. That is totally understandable, and probably inevitable. The main reason this felt so...sucky for lack of a better term, is that we had multiple discussions…

I once worked at a company that dealt with DS. Rumors where that we paid more than double that amount. The integration never really took off, so in the end, it was a huge waste of money.
Post reply on HN