Access-code lockout recovery

An access code is a second secret on a signing link. After five incorrect tries the page locks: Too many incorrect access codes. Try again in 15 minutes. Unlock returns HTTP 429 with locked: true and retryAt. That is a PIN lockout, not a public API traffic rate limit, and not HTTP 429 on /api/v1 for send volume. Recovery is waiting — or entering the correct code after the window. There is no desk control that unlocks a signer early.

When to set a code at all is when to require an access code. How the hash and the send form work is access codes for sensitive envelopes. Desk help is Docs. This guide is the lock screen: what it is, what it is not, and what to do instead of cloning the envelope.

What the signer sees

• An empty unlock returns Enter the access code the sender gave you.
• A wrong code returns That access code is incorrect. N attempts remaining.
• The fifth miss locks the page for 15 minutes.
• Opening a gated file or complete route without unlocking returns This envelope requires an access code.

The same optional Web Form PIN uses the same five-try, 15-minute lockout. After five wrong guesses the form returns HTTP 429. That is a Web Form PIN lockout, not an API send cap. Ask Inkpacket for PIN lockout or access code locked to open help. Those phrases stay on the product screen. This article is the public recovery note.

When the failure count clears

Wait 15 minutes, then try again: the failure count clears when the lockout ends, or when the correct code is entered. Changing a Web Form access code resets that form’s failure count. There is still no button on the desk that reaches into a live signing page and clears an envelope lock early. Tell the signer the wait. Do not send a second envelope because they typed the PIN from the invite thread — the code is not in the invite email.

What you should not do

• Do not void the envelope to “reset the PIN.” Void kills every signing and embed link.
• Do not correct the recipient unless the email is actually wrong. Correct retires the old token if the address changes.
• Do not POST send again. That is a second envelope toward the monthly cap.
• Do not paste the code into the same page as a public embed URL.

If they never received the code, share it on a second channel. If invite email was not sent, the desk already told you to copy the signing link and share the code separately. Resend emails the existing link; it does not email the PIN. When to void, correct, or resend stays on that envelope id.

Iframe and SMS still use the same lock

An embed shows the lock screen inside the iframe. The parent hears nothing useful until they unlock. Do not advance your portal UI because postMessage has been quiet — they may be waiting out the 15 minutes. Embedded iframe parent page checklist is that parent. Text-message (SMS) is coming soon. Reminders go out by email today. Inkpacket does not text a signing link. An access code is shared separately. A lockout is a PIN limit.

What the 429 is not

• Not HTTP 402 ENVELOPE_LIMIT. That is a send that did not go out.
• Each API token allows 120 requests per minute per token. Over that limit, /api/v1 returns HTTP 429 with a Retry-After header. Inkpacket does not send X-RateLimit headers. The monthly send cap is HTTP 402 ENVELOPE_LIMIT, not a 429.
• Not a webhook failure. Delivery retries are a different queue.
• Not a void. The envelope stays SENT. The link still exists after the window.

If the work still needs a signature after they wait, they enter the code and continue on the same token. If the deal is off, void the envelope and tell them out of band — void does not email the signer. If they refuse, they decline with a reason. That closes the envelope. A lockout is not a decline.

Caps and what is not open yet

A lockout is not a send. The send that created the envelope already counted. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. None of those flags clear a PIN lock. The FAQ and access codes on Features state the five-try, 15-minute rule.

Wait 15 minutes. Share the code on a second channel. Stay on the same envelope. Then file what they signed. Open a workspace on Free — see published pricing — set a code on a throwaway send, miss it five times on purpose, and watch the lock so the recovery is something you have seen before a real signer hits it.