The signing page
What this page is — the ceremony a signer goes through after following a signing invitation, step by step, with what each message means.
What it is for — so a signer outside your organisation can sign properly, and the signature is bound to the exact document they saw.
The problem it solves — print, sign and scan loses the link between a signature and the document, and a stuck signer has no idea what an error means.
Route: /papers/sign/<token> · Permission: none — the emailed link is the credential
A signing link is a one-time credential that only ever appears in the invitation email, and it belongs to the person it was sent to. There is no safe way to photograph a live one.
1. What it is
A signing request (sometimes called an envelope) contains one or more sealed documents and a list of signers. Each signer gets their own link. Opening it starts a ceremony that ties this person to these exact bytes and records their consent.
| Signing page | Counterparty portal | Customer portal | |
|---|---|---|---|
| Purpose | Sign or decline | Negotiate | See and act on all their documents |
| Identity check | Email code, unless the sender chose magic link only | None beyond the link | Their customer sign-in |
| Document shown | The sealed copy | The live render, redacted | The live render, redacted |
2. Why you would use it
- The signature means something. The record holds who signed, when, from which IP address and browser, the exact consent wording, and the document's hash. An emailed "signed.pdf" holds none of that.
- Nothing to install, no account to create. Fewer signers give up halfway.
- A "no" becomes a decision, not silence. Declining with a reason tells the sender what to fix instead of leaving them to chase.
- The result verifies itself. The finished PDF carries a completion certificate and its own verification code.
3. Step by step
- Review. The document shown is the finalized PDF, and it cannot change after the invitation.
- Verify it's you. With Email OTP verification, a 6-digit code goes to the invited address.
- The code is valid for 10 minutes.
- A new code can be requested after 60 seconds.
- After 5 wrong entries you must request a new code.
- With Magic link only this step is skipped.
- Spoken attestation. Shown only when the document type sets voice attestation to optional or required. The signer records a short statement, up to 10 MB of audio. The transcript and an audio fingerprint are attached to the signature.
- Your signature fields. The places on the document assigned to you.
- Consent and sign. The signer accepts this exact text, which is stored with the signature: "I agree to conduct this signing electronically and adopt the marks I place on this document as my legally binding signature."
The page then shows You have signed. In a sequential request, the next signer is emailed at this moment. When the last signer finishes, the signed PDF and certificate are built and the sender is notified.
4. Field reference — what the page tells you
The public page reports problems as short codes. What each one means:
| Code | What happened | What to do |
|---|---|---|
invalid_or_expired_link | The link is malformed or past its expiry | Ask the sender for a new request |
link_superseded | The sender reassigned your signature, and your link was replaced | Use the newest invitation |
request_closed | The request was completed, voided or declined | Nothing — ask the sender if you expected to sign |
not_your_turn | Sequential signing, and someone before you has not signed | Wait for your own invitation |
otp_recently_sent | You asked for a code less than 60 seconds ago | Wait, then resend |
otp_incorrect | The code does not match | Re-enter it carefully |
otp_expired_request_new | More than 10 minutes passed | Request a new code |
too_many_attempts_request_new | 5 wrong entries | Request a new code |
no_email | Your signer record has no email for the code | The sender must reassign with an email |
email_unavailable / email_failed | The code email could not be sent | Try again shortly; tell the sender if it persists |
already_acted | You already signed or declined | Nothing further is needed |
5. Declining
Decline to sign asks for a Reason (required). Declining closes the whole request for every signer, not only your part. The page then shows Signing declined, and the sender is notified with your reason.
This is by design. A contract one party refused cannot sensibly collect the others' signatures. The sender fixes the issue and sends a new request.
6. Worked example
Rahul, CFO of Acme, is the second of two signers on Supply Agreement SA-2026-008. The request is sequential with email-code verification.
- On Monday he opens his invitation early and gets
not_your_turn, because the supplier's director has not signed yet. - The director signs on Tuesday at 09:12. Rahul's invitation arrives a minute later.
- He opens it, reads the six pages and clicks to verify. The code arrives. He mistypes it once
(
otp_incorrect), then enters it correctly. - The type requires attestation, so he records: "I, Rahul Menon, confirm I am authorised to sign this agreement for Acme."
- He places his signature and date in the two highlighted fields, accepts the consent text and signs.
- The request becomes completed. Both parties receive the signed PDF, which carries a certificate page listing both signers, the hash chain and a new verification code.
7. The admin contract
| What must be configured | Otherwise |
|---|---|
| The document is finalized before the request is created | The request is refused — document "…" must be finalized before requesting signatures |
| Outbound email | Invitations and codes cannot be delivered (email_unavailable) |
Voice attestation on the type (voice_attestation: optional or required) | No attestation step |
| Signature anchors in the template | Signature marks have no designated place on the page |
| Native signing provider (the only one available) | Other providers answer "not configured"; SMS codes are not supported natively |
8. Downstream
- Each signature adds an event to the request's hash chain. Completion adds a fully executed event to
the document and fires the
paper.fully_executedwebhook. - If the type has an
all_signedlifecycle transition, the document moves on by itself. Without one it stays where it is and must be moved by hand — see sending for signature. - The signed PDF's code resolves on the verification page with the signed flag set.
9. Don't confuse this with…
| Share links | Show a document. This asks for an act |
| Counterparty portal | For negotiating. By signing time, the wording is settled |
| Approval | An internal decision in the approvals inbox, never done here |
10. Troubleshooting
| Symptom | Cause |
|---|---|
| The code never arrives | Check spam and the invited address; after 60 s request another; the sender can reassign to a corrected email |
| Link worked yesterday, not today | Expired, voided, or replaced by a reassignment |
| One signer declined and nobody else can sign | Declining closes the request for everyone (§5) |
| Second signer got nothing | Sequential order — they are invited when the first signs |
| No attestation step although expected | The type's voice attestation setting is off |