What is a signing link?

Why the link is treated as an identity factor

Emailing a document and asking somebody to sign it is, at bottom, a bet that the person holding that inbox is the person named on the page. The link is how that bet is placed. It is minted for one recipient row at the moment that recipient is invited, it carries a token that belongs to nobody else on the envelope, and every action taken through it is recorded against that recipient rather than against a general audience. Where no other check is set, the link is the whole of the identity evidence, which is a reasonable position for a routine agreement between two known parties and a poor one for anything a stranger could profit from. Adding an access code or an emailed one time code does not replace the link. It sits on top, so the signer needs both the inbox and the second thing.

What a recipient sees before proving who they are

Opening the link does not open the document. The first response is deliberately thin: the envelope title, the sender's message, the recipient's own name, email and role, which identity check applies, and the version of the consent wording. Nothing about the contents is released at that point, so a link that lands in the wrong inbox gives away a subject line and very little else. Only once the check passes does the server issue a short lived signing session and hand over the file. That session lasts thirty minutes and is held in memory rather than written into the browser, so a refresh sends the signer back through the check. Mildly annoying on a slow train, and exactly right for a document somebody may leave open on a shared screen in an office.

Three ways a link stops working

The envelope expires thirty days after it is created. That window is fixed, no screen anywhere shortens or extends it, and an expired link answers with a plain message saying the signing request has expired. The sender withdraws the envelope, and the link then answers that the document was withdrawn by the sender. Or the sender resends the invitation, which rotates the token, kills the previous link outright, clears any lockout the recipient had collected and resets the record of whether they had opened it. That last one catches people who dig an older email out of the archive after asking for a fresh one. The most recent email is the only one that opens anything, and every earlier copy has become a dead address that reveals nothing.

Forwarding, and what it does to the record

A forwarded link still works, which is the honest and uncomfortable part. Whoever holds it can pass the check if the check is the link alone, apply a mark and complete the document, and the trail will show that recipient signing. What the trail does capture is the network address and the browser string behind each event, so a signature applied from an unexpected place is at least visible afterwards, and the same address is printed against that signer on the certificate of completion. The invitation email states plainly that the link is personal and asks the reader not to forward it, which is worth something and is not a control. Where a forward would be a real problem, the answer is a second factor, not a firmer warning.

Matching the check to what is at stake

For an internal acknowledgement, the link on its own is proportionate and anything more is friction nobody thanks you for. For a supplier agreement, add an access code: at least four characters, never shown back through the interface, and handed to the signer some other way, by phone or in person. Five wrong attempts lock that recipient out for fifteen minutes, so guessing is slow and noisy. For a counterparty nobody has met, use the emailed one time code, which is six digits, valid for ten minutes, redeemable once and capped at five codes in any ten minute window. Neither option stops somebody who controls both the inbox and the phone. Both make casual forwarding useless, and casual forwarding is the realistic threat.

Questions people ask