Configuration

How configuration is read

The bundle is an AbstractBundle whose extension alias is adobe_sign. Symfony reads your YAML (or PHP) files, merges them per environment, validates them against the tree the bundle declares, and the bundle turns the result into service definitions when the container is compiled. Three consequences follow:

• Types are checked at build time. A string where an integer belongs (base_uri_ttl, dedupe_ttl, retries.max) fails cache:clear with a clear message. With an environment variable, cast it: '%env(int:ADOBE_SIGN_DEDUPE_TTL)%'.
• Values are checked when used. auth and signature_level are plain strings in the tree. The manager validates them the first time it builds a client and throws MisconfiguredException naming the key, so a typo can't silently fall back to a default.
• Services are referenced by id. cache_pool, oauth.token_cache_pool, http_client, oauth.token_store, oauth.user_key_resolver and webhooks.messenger.bus take service ids. A missing id fails the container build, except http_client, which falls back to discovery (see the HTTP client).

Two console commands show what Symfony actually resolved:

php bin/console config:dump-reference adobe_sign   # the tree with defaults and help texts
php bin/console debug:config adobe_sign            # your merged values for the current env

The full tree with defaults

Every value below is the default. You only write the keys you change; for an Integration Key setup that is usually just integration_key.

adobe_sign:
    auth: integration_key            # "integration_key" or "oauth"
    integration_key: ~               # usually '%env(ADOBE_SIGN_INTEGRATION_KEY)%'

    oauth:
        client_id: ~
        client_secret: ~
        redirect_uri: ~              # default: absolute URL of route adobe_sign_oauth_callback
        scopes:
            - 'user_login:self'
            - 'agreement_read:self'
            - 'agreement_write:self'
            - 'agreement_send:self'
            - 'webhook_read:self'
            - 'webhook_write:self'
        redirect_after: /
        user_key_resolver: ~         # service id; default keys tokens by getUserIdentifier()
        token_store: cache           # "cache", "doctrine" or a TokenStore service id
        token_cache_pool: cache.app
        encryption_key: '%kernel.secret%'
        doctrine:
            connection: default
            table: adobe_sign_tokens

    signature_level: ses             # ses, aes or qes (any case)
    qualified_issuers: []

    bootstrap_url: 'https://api.adobesign.com'
    base_uri_ttl: 86400              # seconds
    retries:
        max: 3
        max_delay_seconds: 60.0
    cache_pool: cache.app
    http_client: ~                   # PSR-18 service id

    webhooks:
        client_ids: []               # empty: [oauth.client_id]
        dedupe_ttl: 259200           # 72 hours
        messenger:
            enabled: false
            bus: messenger.default_bus

Authentication

auth: oauth changes only what the default client is. $manager->forUser($user) works in either mode, as long as the oauth section is filled in. A common mix: keep auth: integration_key for system jobs and call forUser() where a user sends from their own account. See injecting the manager.

OAuth application and routes

Token storage

The trade-offs between the stores, and key rotation, are covered in Token storage & Doctrine.

Signature level

See Signature levels for overrides per agreement and per signer.

Data centres, cache, HTTP and retries

framework:
    cache:
        pools:
            adobe_sign.pool:              # data centres + webhook dedupe
                adapter: cache.adapter.redis
                provider: '%env(REDIS_URL)%'
            adobe_sign.tokens:            # OAuth tokens: no default_lifetime!
                adapter: cache.adapter.redis
                provider: '%env(REDIS_URL)%'

adobe_sign:
    cache_pool: adobe_sign.pool
    oauth:
        token_cache_pool: adobe_sign.tokens

Logging

There is no logging key. The manager and the webhook controller are tagged with the Monolog channel adobe_sign, so with MonologBundle their logs go to monolog.logger.adobe_sign, which you route like any channel. The SDK logs each request at debug, throttling retries at warning and requests that could not be sent at all at error; it never logs headers or bodies. The webhook controller logs rejected client ids (warning) and unreadable bodies (error). See Logging.

Webhooks

Environment variables and secrets

Any scalar value can come from the environment. The bundle doesn't read environment variables itself; it receives whatever your config resolves to. The usual set:

adobe_sign:
    integration_key: '%env(ADOBE_SIGN_INTEGRATION_KEY)%'
    signature_level: '%env(default:adobe_sign_default_level:ADOBE_SIGN_SIGNATURE_LEVEL)%'
    oauth:
        client_id: '%env(ADOBE_SIGN_CLIENT_ID)%'
        client_secret: '%env(ADOBE_SIGN_CLIENT_SECRET)%'
        encryption_key: '%env(ADOBE_SIGN_TOKEN_KEY)%'
    webhooks:
        client_ids: ['%env(ADOBE_SIGN_CLIENT_ID)%']   # one variable per list item
        dedupe_ttl: '%env(int:ADOBE_SIGN_DEDUPE_TTL)%'

parameters:
    adobe_sign_default_level: ses

• List keys (client_ids, qualified_issuers, scopes) can't take one variable for the whole list: Symfony rejects "a dynamic value" on array nodes, so '%env(csv:VAR)%' fails the build. Put one %env()% per item instead.
• int: is needed for integer keys, because environment variables are strings.
• default:param:VAR falls back to a parameter when the variable isn't set.
• Secrets (php bin/console secrets:set NAME) are read through the same %env()% syntax, so production can use the vault without changing the config.

Examples per environment

Symfony merges config/packages/adobe_sign.yaml with config/packages/<env>/adobe_sign.yaml, or with a when@<env>: block in the same file. Use whichever your project already uses.

Local development

adobe_sign:
    # A developer account: agreements get "[DEMO USE ONLY]" and aren't legally meant.
    integration_key: '%env(ADOBE_SIGN_INTEGRATION_KEY)%'
    oauth:
        # The tunnel's host, so Adobe's redirect matches what you registered.
        redirect_uri: 'https://my-tunnel.example.com/adobe-sign/oauth/callback'

The test environment

when@test:
    adobe_sign:
        integration_key: 'test-key'
        http_client: test.adobe_sign_http     # a mock PSR-18 client, see Testing
        webhooks:
            client_ids: ['test-client-id']

    services:
        test.adobe_sign_http:
            class: Http\Mock\Client
            public: true

The Testing page explains why the mock is public and how to keep it alive between requests.

Production on several servers

adobe_sign:
    integration_key: '%env(ADOBE_SIGN_INTEGRATION_KEY)%'
    signature_level: aes
    cache_pool: adobe_sign.pool              # Redis, shared by every web server and worker
    retries:
        max: 5
        max_delay_seconds: 30                # longer waits become RateLimitException
    webhooks:
        client_ids: ['%env(ADOBE_SIGN_CLIENT_ID)%']
        messenger: true                      # route the message to an async transport

A SaaS where customers connect their own accounts

adobe_sign:
    auth: oauth                              # AdobeSign service = the signed-in user's account
    oauth:
        client_id: '%env(ADOBE_SIGN_CLIENT_ID)%'
        client_secret: '%env(ADOBE_SIGN_CLIENT_SECRET)%'
        redirect_uri: 'https://app.example.com/adobe-sign/oauth/callback'
        redirect_after: /settings/integrations
        token_store: doctrine
        encryption_key: '%env(ADOBE_SIGN_TOKEN_KEY)%'   # rotate APP_SECRET without disconnecting users
        user_key_resolver: App\AdobeSign\TeamKeyResolver
        scopes:
            - 'user_login:self'
            - 'agreement_read:account'
            - 'agreement_write:account'
            - 'agreement_send:account'
            - 'webhook_read:account'
            - 'webhook_write:account'
    webhooks:
        messenger: true

Changing values at runtime

You can't. The configuration is compiled into the container, and the manager receives it as a constructor argument. That is deliberate: credentials in one place, validated once. If different tenants need different Integration Keys, build a core client per tenant with the core's named constructor and pass the bundle's services in, rather than mutating configuration:

use Conceptlz\AdobeSign\AdobeSign;

$client = AdobeSign::withIntegrationKey($tenant->adobeSignKey(), cache: $psr16Cache, logger: $logger);

Inject $psr16Cache as the service adobe_sign.cache (for example with #[Autowire(service: 'adobe_sign.cache')]) so the data-centre lookup is shared.

Common questions

• Using the clientAutowiring, the manager's methods and core builders in Symfony code.
• Token storage & DoctrineChoose where OAuth tokens live and how they are encrypted.