Protecting a signing link: access codes, one-time codes and expiry
Three ways to make sure the email alone is not enough to open a document, and what happens to a link once it has been used.
A signing link is a private address, and anyone who holds it can open the document until it is used or expires. If the document matters, add one or more of the protections below.
The three protections compared
| Access code | One-time code | Expiry | |
|---|---|---|---|
| What it checks | The signer knows a secret you chose | The signer can read the email, WhatsApp or text message the envelope was sent to | The link is still inside its window |
| Who sets it | You, per recipient | You, per recipient | You, per envelope (or an organisation default) |
| Where | Prepare screen, Access code (optional) on the recipient row | Prepare screen, recipient ⚙ panel, 🔐 Verify | Prepare screen, Options → Expires after |
| Who delivers it | You, separately from the invitation | SignSpry, when the signer asks | Not applicable |
You can use all three on the same recipient.
Access codes
Type a code of up to 24 characters in the Access code (optional) box on a recipient's row. The invitation email tells the signer that the envelope is protected and that you will share the code separately. Tell them by phone or in a different message, not in the same email as the link.
- The signer opens the link and sees This document is protected.
- They type the code and press Open.
- A wrong code shows "Wrong code — check with the sender and try again", with the number of attempts remaining.
A few things to know:
- Five wrong tries lock the link. The page stops accepting codes. Choose More → Remind pending signers on the envelope page: that sends a fresh link and resets the count.
- Every try is in the audit trail, successful or not.
- You cannot read the code back. SignSpry keeps only a scrambled (hashed) form of it. The Signing links panel shows "set by you" instead. Keep your own note.
- A coded link cannot be handed on. The Assign to someone else option is not offered, because the new person would not have the code. See In-person signing, reassignment and witnesses.
- The unlock lasts for that browser session. A link opened on another device asks for the code again.
- Through the API, the field is
access_code.
One-time codes
A one-time code proves the signer can read the address or number you sent the envelope to. They see Confirm it's you, press Send me a code and type six digits. The code is valid for 10 minutes. Setting it up and the limits are in Asking a signer to confirm a one-time code.
The signer meets the checks in this order: your access code, then the one-time code, then the US ESIGN disclosure if it is on, then the document.
Expiry
Choose 7, 15, 30 or 90 days, or Never, under Options → Expires after when you prepare an envelope. The starting value comes from Admin → Signing defaults → Envelopes expire after. When an envelope expires its links stop working and the signer sees "This envelope has expired" or, on a link already closed, a page saying the document expired before everyone signed. You can send a fresh copy from the envelope page. More in Reminders, expiry and scheduled sending.
Links close when they are used
Once a signer has signed or declined, their old link no longer opens the document. It opens a page headed This signing link has been used. If the envelope is complete, the page offers Email me a fresh link, which sends a private link to the sealed copy to the address on file, shown with part of it hidden.
- A copy link works for 30 days.
- A new one can be requested once every ten minutes.
- It only ever opens the finished, sealed PDF, never the signing page.
Two other pages you may see: Not your turn yet, when a signing order is set and earlier signers have not finished, and a message for CC recipients, who receive the copy only when everyone has signed.