Getting a DocuSign access token for an SSO user - docusignapi

Question

I'm trying to get access tokens for users in order to use the iOS SDK for integrating in-person signings.
Our DocuSign users are set up as Single sign-on. We have a non-SSO, API user configured with the user settings apiAccountWideAccess and allowSendOnBehalfOf enabled.
I request an access token for the non-SSO, API user as follows:
POST /restapi/v2/oauth2/token HTTP/1.1
Host: demo.docusign.net
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
grant_type=password&client_id=<client_id>&scope=api&username=<useranme>&password=<password>
This results in the following response:
{
"access_token": "<access-token>",
"token_type": "bearer",
"scope": "api"
}
I then use the access token from the above response to try to get an access token for an SSO user as follows:
POST /restapi/v2/oauth2/token HTTP/1.1
Host: demo.docusign.net
Authorization: Bearer <access-token-from-response-above>
Accept: application/json
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
grant_type=password&client_id=<client_id>&username=<email-address-of-sso-user>&password=&scope=api
This results in the following response:
{
"errorCode": "UNSPECIFIED_ERROR",
"message": "Object reference not set to an instance of an object."
}
I'm following the documentation here (Obtaining access_tokens for Other Account Users).
Is it possible to get access tokens for the REST API on behalf of SSO users?

Answer 1

Unfortunately you can not use the API as a SSO enabled user at this time.
If you need to use the API as a SSO user, you have to have that user on the SSO Exempt list.
Generally integrations use Send On Behalf Of to authenticate as the API user (that on the exempt list) and makes the calls on behalf of the users who have SSO enabled.
The error doesn't indicate the actual issue and I've filed a bug with DocuSign Support to get that portion addressed.