When to set a Web Form access code

A Web Form slug is a public door. Anyone who has /form/SLUG can start a fill unless you set an optional access code on publish. That PIN is not the same field as an envelope access code on Documents → new. You store it on the form. Every later fill inherits it. Envelopes already created keep the code they were born with. Share the PIN separately from the slug — a public page plus a PIN in the same paragraph is not a second factor. That is web-form-pin honesty: the lock belongs to the door, not to one named recipient you already have.

When an envelope link needs a PIN is when to require an access code. How the hash and lockout work is access codes for sensitive envelopes. Publishing the slug is publish a Web Form from a template. Weekly operations are operating a Web Form share link. Desk help is Docs and Docs. This guide is the publish decision.

The FAQ states the same optional code on the form. Features names it under access codes and Web Forms. Ask Inkpacket for when to set a Web Form access code to open this article. Ask Web Form PIN to open help. Those phrases stay on the product screens. This article is the public version of why a stranger’s door sometimes needs a second secret.

Set it on publish when the slug would leak the PDF

• The form collects identifiers, compensation, or bank details.
• You will paste /form/SLUG in a channel you do not fully control.
• A forwarded bookmark should not be enough to start a fill.
• You can tell the cohort the PIN on a second channel.

Skip the code when the PDF is already public enough that a leaked slug is an inconvenience — a handbook acknowledgment, an event waiver, a form the visitor expected. A surprise lock on an open campaign looks like a broken page. Preview traffic on an open slug is not an envelope; submit is. The PIN does not change that count.

Inheritance, not a per-fill PIN

Monday’s fill keeps Monday’s code. Tuesday you change the published PIN. Wednesday’s fill uses Tuesday’s hash. Monday’s envelope does not move. Do not open Envelope admin on Monday’s id expecting a new code. Do not void Monday because the form changed. File Monday on the secret it was born with.

Closing the form stops new fills. It does not unlock or re-lock envelopes already created. Public form closed copy is that door. Existing signers still finish — unless you void that envelope or its own window ends.

Share it separately

Inkpacket stores only a hash. The desk shows the plaintext to the sender so you can copy it. The public page does not print the PIN next to the slug. After five wrong guesses the form returns HTTP 429. That is a Web Form PIN lockout, not ENVELOPE_LIMIT and not a published-form cap. The signer waits 15 minutes. Access-code lockout recovery is the wait.

Do not put the code in the same chat paragraph as /form/SLUG. Do not print it on the campaign poster under the QR. A second channel — a call, a roster email you write yourself, a hallway — is the point. The same rule as an envelope invite: the link and the PIN travel apart.

Not the send-form PIN

Documents → new #access-code locks one named recipient’s token. A Web Form PIN locks every stranger who opens the slug. Do not set an envelope code hoping the public form inherits it. Do not publish a form hoping it locks last week’s desk send. Two objects, two fields. Bulk send can share one optional code across a job — that is still outbound rows, not a slug.

The click-path

1. Save a template with at least one field. Publish at /desk/forms#publish.
2. Set the optional access code before you share the slug.
3. Tell the cohort the PIN somewhere that is not the slug paragraph.
4. Leave already-created envelopes on the code they inherited.
5. Disable the form when the cohort is done. Do not publish a twin slug to “change the PIN.”

A second publish spends a published-form slot. Free includes 1 published Web Form. Hitting that gate returns HTTP 402 and names the plan limit — not the PIN 429. Disable the form you have, then re-enable if the same slug should take fills again with the new code.

Caps and what is not open yet

A fill that goes out counts. Free allows 5 packets a month. Free at 5 packets a month is the live cap this fill shares with desk send, bulk rows, and API send. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Those flags do not waive the PIN or invent a second Free slug. The FAQ and access codes on Features use share the code separately in the same words.

Lock the door when the PDF is a leak. Leave it open when speed is the product. File each completed fill from its envelope — the slug was only the door. Open a workspace on Free — see published pricing — and publish a throwaway with a PIN so lockout and inheritance are something you have watched.