For sensitive agreements, CornerSpot can require each recipient to enter a one-time access code before they can open the document. It's an extra identity check on top of the unique signing link. This guide explains how you turn it on as the sender, and exactly what your recipient experiences.
What is an access code (OTP)?
An access code is a 6-digit one-time code emailed to the recipient's address on file. When an envelope is sent with this option enabled, the recipient can't view the document until they request a code and enter it correctly. The code expires after 15 minutes and is good for a single use, so a forwarded link alone isn't enough to open the document.
Turn on an access code as the sender
You enable the access code on the envelope before you send it.
1. Open your draft envelope
From E-Sign, create or open a draft envelope and get it ready to send — at least one document, one recipient, and one field for a signer to complete.
2. Open Settings and enable “Access code (OTP)”
In the builder's right rail, click Settings to open the Envelope settings panel. Turn on Access code (OTP) — “Require recipients to enter a one-time code” — then click Done to save. Settings are saved when you click Done and are applied to the signer access rules.
3. Send the envelope
Click Send for signature. The confirmation dialog notes that recipients will need an access code (sent separately), alongside the recipients and roles. Confirm with Send envelope to deliver the signing links.
What your recipient experiences
When the recipient clicks the link in their invitation email, they don't go straight to the document — they're asked to verify their identity first.
1. “Verify your identity”
The recipient sees a Verify your identity step explaining that the sender requires an access code. They click Send code to have a one-time code emailed to their address on file.
2. Enter the code from the email
CornerSpot emails a 6-digit code in a separate message. The recipient copies it from that email and enters it in the Access code field. If it doesn't arrive, a Resend code option sends a fresh one (with a short cooldown between requests).
3. Verify and continue
The recipient clicks Verify and continue. Once the code checks out, the document unlocks and they proceed to consent and signing as normal.
If the code doesn't work
- Mistyped or expired code: the page shows “Invalid or expired code.” The recipient can request a fresh one with Resend code — each code expires after 15 minutes and is single-use.
- Too many attempts: repeated failures are rate-limited, with a short wait before trying again.
- Code never arrives: ask the recipient to check spam, confirm you sent it to the right email, and use Resend code. Because the code goes to their address on file, it's also a quick way to confirm you have the correct contact details.
When to require an access code
- Use it for sensitive or high-value agreements where you want an extra check that the right person is signing.
- It pairs well with an expiration date and the audit trail for a tighter, verifiable signing process.
- For routine, low-risk documents you can leave it off — the unique signing link is already specific to each recipient.