Asking a signer to confirm a one-time code
Check a signer holds the email address or phone you sent to, with a six-digit code, before the document opens.
A one-time code proves that the person opening the link really holds the email address (or phone) you sent it to. The signing page sends them a six-digit code and waits for it before the document opens.
Set it for a recipient
- On the prepare screen, open the recipient's ⚙ panel.
- In the 🔐 Verify row, choose how the code should travel: No code (the default), Code by email, Code by WhatsApp or Code by SMS.
- For WhatsApp or SMS, also fill in the 📱 Text row's phone number. Without a phone number the code can't go by text, and you'll be asked to add one.
Code by email is always available. The WhatsApp and SMS choices appear only where SignSpry has switched those channels on; see WhatsApp and SMS for signers.
From the API, set recipients[].verify to email, whatsapp or sms.
What the signer sees
- They open their link and land on Confirm it's you, which says where the code will go (with the address or number partly hidden).
- They press Send me a code and type the six digits.
- The document opens.
If you also gave the recipient an access code, they enter that first and the one-time code second. If you turned on the US ESIGN disclosure, they read that after both.
The limits
| What | Limit |
|---|---|
| A code works for | 10 minutes |
| Wrong tries per code | 5 |
| Asking for a new code | After 60 seconds |
| Codes per recipient | 5 in total |
After five codes the signer sees Too many codes have been sent. Ask the sender to send the envelope again. Contact them and send the document again as a new envelope.
The check lasts for the browser session. A link opened on another device asks again.
When the text can't be sent
If you chose WhatsApp or SMS but the signer's code can't go that way (the channel is off, the number has opted out, or it's an Indian number and SMS isn't registered yet), the code goes by email instead. The audit trail says that WhatsApp or SMS wasn't available, so the record stays honest.
What gets recorded
- The audit trail shows when the code was sent, wrong tries, and when it was verified, including the channel used.
- The certificate of completion prints a line such as Identity check: One-time code · WhatsApp · +44 77••••0201, with the time.
- On the envelope page the recipient carries a verification tag that changes to verified.
Only a scrambled (hashed) form of the code is kept; the code never appears in logs or subject lines.
Good to know
- If you open your own envelope with Sign now while signed in to SignSpry as that address, the check is skipped, and the trail says why.
- When a signer uses Assign to someone else, the new person keeps the check, but by email, because SignSpry has no phone number for them.
- A one-time code protects against a forwarded email; an access code is a secret you share yourself. Use whichever fits, or both.