When to require an access code

A tokenized signing URL is a capability. Anyone who has it can open the PDF unless you add a second secret the invite email does not carry. An access code is that optional PIN. Leave the field blank when a leaked link is an inconvenience. Set a code when a leaked link is a leak.

How the hash, the lockout, and the send form work is access codes for sensitive envelopes. Desk help is Docs. Features is access codes. This guide is the decision: when the extra lock is worth the extra step for the signer.

Require a code when a forwarded URL would be a leak

Use a PIN when the PDF should not open for whoever happens to have the link. Compensation on an offer letter. Identifiers on an intake form. Bank details on a vendor envelope. Anything you would not paste into a public thread. The invite can be forwarded. The URL can land in the wrong inbox. The code should not travel with it.

Share the PIN in a chat, a call, a second email you write yourself, or a channel your team already uses for credentials. The FAQ states the same rule: share the code separately from the signing link. A public Web Form page plus a PIN in the same paragraph is not a second factor — Web Form intake inherits one optional code for every later fill.

Skip the code when speed is the product

Leave the field blank when the document is already public enough that a leaked link is not a problem — a standard acknowledgment, a form the recipient expected, an envelope you will complete in the room while you watch. An open link is faster. A surprise PIN looks like a broken page. Tell the signer they will see a lock screen first if you do set one.

• Set a code when a forwarded invite would expose the PDF.
• Leave it blank when the file is not sensitive and you want fewer support pings.
• Generate one on the form if you do not want to invent a PIN.
• Use the same optional code on a bulk job when every row shares that sensitivity. Two groups, two jobs.

What the signer hits

They type the code before the PDF renders — on /sign/TOKEN and inside /embed/sign/TOKEN. After five incorrect tries the page locks for 15 minutes. That is a PIN lockout, not a public API traffic rate limit, and not HTTP 429 on /api/v1. Wait it out or walk them through the code again. Do not mint a second envelope because they mistyped.

Inkpacket stores only a hash. The desk shows the plaintext to the sender so you can copy it. The API hashes accessCode on POST /api/v1/packets/:id/send and returns the plaintext once. Do not log that plaintext next to the URL in a public channel. Embed signing versus a signing link still shows the lock screen inside the iframe. Share the PIN separately from a host page that is reachable without a login.

What a code does not do

• It does not add days. Expiration is a separate field — how to choose an envelope expiry.
• It is not knowledge-based authentication, notary, or a qualified electronic signature. Those stay out of this pass.
• It is not a workspace login. The signer still does not create an Inkpacket account.
• It does not stop an envelope you need closed now. Void the envelope — when to void, correct, or resend.
• It does not rewrite a completed PDF. Completed envelopes cannot be voided.

Resend emails the same token; the hash stays. Correct keeps the code you set at send even when the email changes. Void kills every link; the PIN is irrelevant once the token is dead. Reminders do not include the code. What happens after a signing reminder fires is that job.

One code per job or form

A bulk send applies one optional code to every row. You do not set a different PIN per email in this pass. Bulk send for HR and sales envelopes walks the list. A published Web Form stores one optional code; every fill inherits it. Envelopes already created keep the PIN they were born with.

Caps and what is not open yet

Setting a code does not change the monthly envelope count. The send still counts. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. The envelope still exists. If Resend is missing, copy both the signing URL and the PIN yourself. The FAQ and More on access codes use those same phrases.

Require a code when the PDF is the secret. Skip it when the link being forwarded is fine. Share the PIN on a second channel. Wait out a lockout instead of cloning the envelope. Then file what they signed. Open a workspace on Free — see published pricing and Free versus paid lanes if you want the proposed ladder — and set a code on the next envelope you would not paste into a thread.