Passwords, two-factor and account security

Protect the account that can send agreements in your name.

Two-factor authentication

Under Account security, enable 2FA. Scan the QR code with any authenticator app — Google Authenticator, Authy, 1Password — and enter the six-digit code to confirm. You'll need a code at every login afterwards.

Save the recovery codes somewhere other than the device running the authenticator.

Anyone who can log in as you can send agreements in your name. 2FA is the single highest-value thing you can switch on here.

Password policy

Admins can set, under Admin → Settings:

minimum length
expiry — force a change every N days (0 for never)
history — block reuse of the last N passwords

Lockout

Repeated failed logins lock an account temporarily, with the attempts recorded. This blunts password-guessing without letting someone lock a colleague out permanently.

Sessions

Logging out ends your session everywhere. If you think an account is compromised, change the password — that invalidates existing sessions.

API keys

An API key is a password that doesn't expire. Revoke keys you no longer use, keep them out of source control, and use test-mode keys in development.

Was this useful?

More in Account & billing

Putting your brand on itLogo, colour and footer across the app, signing pages and every email. Plans, limits and what's includedWhat each plan includes, how seats work, and how to change plan. Setting up Aadhaar eSignThe five things you need before the feature will switch on, and where each one comes from.