Access codes for sensitive envelopes

A signing link is a capability. Anyone who has the URL can open the PDF unless you add a second factor the invite email does not carry. An Inkpacket access code is that factor: an optional PIN the signer must enter before they can view or sign. Leave the field blank and the tokenized URL stays an open link. Set a code when the envelope is sensitive enough that a forwarded email should not be enough.

This guide is the public walkthrough for that option. The in-app notes live at Docs. The marketing version is access codes on Features. If you have not sent an envelope yet, start with how to send a document for signature in under five minutes. If the envelope is already out and you need to stop the link, use envelope admin.

What an access code is — and is not

An access code is a short secret you choose or generate on the send form. The signer types it on the signing page (and inside an embed) before the PDF renders. Inkpacket stores only a hash. The desk shows the plaintext to the sender so you can copy it. The invite email does not include the code.

That last sentence is the whole point. If the code traveled in the same message as the link, anyone who opened the email would have both. Share the PIN in a chat, a call, a second email you write yourself, or a channel your team already uses for credentials. The FAQ states the same rule: share the code separately from the signing link.

An access code is not knowledge-based authentication, not a notary workflow, and not a qualified electronic signature. Those stay out of this pass. It is also not a workspace login — the signer still does not create an Inkpacket account. The code only unlocks that envelope’s view and submit.

When to set one

Use a code when the PDF should not open for whoever happens to have the URL. Typical envelopes: offer letters with compensation, intake forms with identifiers, vendor agreements that include bank details, or any file you would not paste into a public thread.

Skip the code when the document is already public enough that a leaked link is not a problem — a standard NDA, a handbook acknowledgment, a form the recipient expected. An open link is faster for the signer. The optional field exists so you can choose per send.

• Set a code when a forwarded invite would be a leak.
• Leave it blank when speed matters more than a second factor.
• Generate one on the form if you do not want to invent a PIN.
• Use the same optional code on a bulk send when every row in that job should be locked the same way.

How to set it on a one-off send

On the send form — the same screen where you set reminder interval and expiration — there is an optional access-code field. Type a code, or generate one. Send the envelope. The desk shows the code so you can copy it. If Resend is configured, the signer gets the link without the PIN. If mail is not configured, copy both the signing URL and the code yourself.

The five-minute path covers the rest of that form in the timed walkthrough. Cadence and expiry are a separate decision; see reminders and expiry so envelopes don’t stall.

Wrong guesses lock the page

After five incorrect tries the signing page locks for 15 minutes. That is long enough to stop a casual walk of a leaked URL, and short enough that a typo is not a support ticket forever. The hash at rest means a stolen database row is not the PIN. The lockout means a stolen URL is not an unlimited guesser.

Bulk send and embedded signing

The same optional code is available on a bulk send job. It applies to every recipient in that job. You do not set a different PIN per row in this pass — one job, one optional code. If two groups need different codes, run two jobs. Bulk send for HR and sales envelopes walks the list path; More on bulk send is the short version.

Embedded signing uses the same token and the same lock. Iframe /embed/sign/TOKEN or /sign/TOKEN and the signer still enters the code before the PDF. Share the PIN separately from the host page if the page itself is public. Embedded signing on your own site and the embed snippet cover the iframe and postMessage events.

The same option on the public API

Owners and admins mint org-scoped tokens in Settings. On POST /api/v1/packets/:id/send you can pass an optional accessCode. Inkpacket hashes it at rest and returns the plaintext once in the send response so your client can copy it. The response also includes signingUrl and embedUrl. Do not log the plaintext next to the URL in a public channel.

Create and send still accept an Idempotency-Key if your client may retry. The longer developer guide is public API and signed webhooks.

What happens after send

The code does not change because you resend the existing link. Resend emails the same token; the hash stays. If you correct the recipient and the email changes, the previous token is retired and a new invite goes out — the access code on that envelope remains the one you set at send. Voiding the envelope kills every signing and embed link; the code is irrelevant once the token is dead.

Completed envelopes cannot be voided, and an access code does not rewrite a filed PDF. If the wrong person somehow signed, that is an operational problem you handle with a new envelope, not by rotating a PIN on a completed envelope.

Habits that keep the second factor useful

1. Generate or choose the code at send, not in a spreadsheet you later paste into the invite body.
2. Send the link through Inkpacket (or copy it). Send the PIN through a different channel.
3. Tell the signer they will see a lock screen first. A surprise PIN looks like a broken link.
4. If they are locked out, wait out the 15 minutes or walk them through the code again. Do not mint a second envelope just because they mistyped.
5. If the deal is off, void the envelope. Do not rely on the PIN as the only stop.

Access codes are a small lock on a tokenized URL. They belong on sensitive envelopes, on bulk jobs that carry the same sensitivity, and on embeds that sit on a host you do not fully control. They do not replace envelope admin, reminders, or a correct recipient. Open a workspace on Free — billing is published, not charging — and set a code the next time the PDF should not open for whoever has the link.