Signer authentication: five ways to confirm who is signing
BoldSign asks each signer to pass a check before the document opens. The check can be an email or text code, an access code you share, knowledge-based questions, or a government ID with a live selfie. You pick the check for each signer.
- A different check for each signer
- Every check in the audit trail
- Web app and API
- Email OTP (One Time Password)
- SMS OTP
- Access code Access code*48291 Note: You must communicate this access code to the recipient directly.
- Identity VerificationPowered by Stripe
- Knowledge-Based Authentication (KBA)
Why signer authentication matters
BoldSign signer authentication keeps a document in the hands of the person it was sent to, even if the signing link is forwarded.
The wrong person cannot sign
A forwarded or intercepted link is not enough to open the document. The signer must also pass their check.
A record if a signature is questioned
Each check is logged with the signature details, so you can show who verified and when.
The right check for each document
A code is enough for routine paperwork. ID verification or KBA suits documents where identity matters more.
Five signer authentication methods
BoldSign offers three codes and two identity checks. The codes prove access to an inbox, a phone, or a shared secret; the identity checks confirm who the signer is.
Codes that confirm access
Email OTP
BoldSign emails a one-time code to the signer, and the document opens only after they enter it.
How email OTP is set upSMS OTP
BoldSign sends the code by text message to the signer’s mobile number, tying the check to their phone.
SMS OTP questions answeredAccess code
You choose a code and give it to the signer outside BoldSign, for example on a call. BoldSign asks for it before the document opens.
Change an access code
Checks that confirm identity
Knowledge-based authentication (KBA)
BoldSign asks US signers questions drawn from public records, after they enter their legal name, address, and the last four digits of their Social Security number. No ID upload is needed.
Knowledge-based authenticationID verification
The signer photographs a passport or driver’s license and takes a live selfie, and BoldSign matches the two through Stripe Identity before the document opens.
Signer identity verification
Can each signer on a document get a different check?
Yes, BoldSign sets authentication per signer, so one document can ask a client for an email code and a guarantor for KBA.
How it works
- Choose a check for each signer when you add them to the document.
- The document opens for a signer only after they pass their check.
- Every check is time-stamped in the document’s audit trail.
Good to know
- You can add a check to a signer after the document is sent.
- If a signer fails KBA or ID verification more times than you allow, the document locks for them until you reset or remove the check.
- Email OTP (One Time Password)
- SMS OTP
- Access code
- Identity VerificationPowered by Stripe
- Knowledge-Based Authentication (KBA)
- Email OTP (One Time Password)
- SMS OTP
- Access code
- Identity VerificationPowered by Stripe
- Knowledge-Based Authentication (KBA)Verification frequency : Every access
Compare signer authentication methods
The table shows what each BoldSign method asks of the signer, the plan that includes it, and what each check costs.
| Method | What the signer provides | Plan | Cost per check |
|---|---|---|---|
| Email OTP | A code emailed to them | Every plan, including the Essential plan | Included |
| Access code | A code you share with them | Every plan | Included |
| SMS OTP | A code texted to their phone | Business plan and above | $0.20 per SMS |
| KBA | Identity details, then answers to questions from public records | Business plan and above | $1.50 per attempt |
| ID verification | A government ID and a live selfie | Business plan and above | $2 per attempt |
Prices are in USD.
Limits and costs to know before you add signer authentication with BoldSign
BoldSign’s code methods show that the signer can open an email, receive a text, or knows the code. They do not confirm who the person is.
- $0.20per SMS OTPThe rate varies by the recipient’s country.
- $1.50per KBA attemptCharged when the signer starts the questions, pass or fail, and again on each retry.
- $2per ID verification attemptEach completed attempt is charged, pass or fail, including retries.
- 10 minlife of an email or SMS codeAfter three resends, the Resend button is locked for 30 minutes.
Before your first authenticated send
- PlansSMS OTP, KBA, and ID verification need the Business plan or higher, from $15 per user a month, billed yearly.
- SMS OTPWorks for mobile numbers in 26 supported countries.
- KBAFor US signers only, with 1 to 3 attempts per signer. No free trial credits.
- ID verificationDoes not read ID details written in Arabic, Chinese, Cyrillic, Greek, Hebrew, Japanese, Korean, Tamil, or Thai script. No free trial credits.
Can developers add signer authentication through the API?
Yes, the BoldSign API sets an authentication type, such as EmailOTP, SMSOTP or AccessCode, on each signer.
Live sending needs the Enterprise API plan, and the free sandbox is for testing. The samples below come from the BoldSign developer guide and send a document with email OTP on one signer.
curl -X 'POST' \
'https://api.boldsign.com/v1/document/send' \
-H 'accept: application/json' \
-H 'X-API-KEY: {your API key}' \
-H 'Content-Type: multipart/form-data' \
-F 'Signers={
"name": "hanky",
"emailAddress": "hankyWhites@gmail.com",
"signerType": "Signer",
"signerRole": "Signer",
"authenticationType": "EmailOTP",
"formFields": [
{
"id": "signid",
"fieldType": "Signature",
"pageNumber": 1,
"bounds": {
"x": 50,
"y": 100,
"width": 100,
"height": 60
},
"isRequired": true
}
]
}
' \
-F 'Files=@{your file}'var apiClient = new ApiClient("https://api.boldsign.com", "{Your API key}");
var documentClient = new DocumentClient(apiClient);
var documentFilePath = new DocumentFilePath
{
ContentType = "application/pdf",
FilePath = "{Your File path}"
};
var filesToUpload = new List<IDocumentFile>
{
documentFilePath,
};
var signatureField = new FormField(
id: "sign",
isRequired: true,
type:FieldType.Signature,
pageNumber: 1,
bounds: new Rectangle(x: 100, y: 100, width: 100, height: 50));
var formFieldCollections = new List<FormField>()
{
signatureField
};
var signer = new DocumentSigner(
signerName: "hanky",
signerEmail: "hankyWhites@gmail.com",
formFields: formFieldCollections,
authenticationType: AuthenticationType.EmailOTP,
locale: Locales.EN);
var documentSigners = new List<DocumentSigner>()
{
signer
};
var sendForSign = new SendForSign()
{
Signers = documentSigners,
Files = filesToUpload
};
var documentCreated = documentClient.SendDocument(sendForSign);
Console.WriteLine(documentCreated.DocumentId);import boldsign
configuration = boldsign.Configuration(host = "https://api.boldsign.com", api_key = "YOUR_API_KEY")
with boldsign.ApiClient(configuration) as api_client:
document_api = boldsign.DocumentApi(api_client)
send_for_sign = boldsign.SendForSign(
title = "Document SDK API",
document_title = "SDK Document Test case",
description = "Testing document from SDK integration test case",
files = ["YOUR_FILE_PATH"],
signers = [
boldsign.DocumentSigner(
name = "Hanky",
emailAddress = "hankyWhites@cubeflakes.com",
signerOrder = 1,
signerType = "Signer",
authenticationType = "EmailOTP",
formFields = [
boldsign.FormField(
name = "Sign",
fieldType = "Signature",
font = "Helvetica",
pageNumber = 1,
isRequired = True,
bounds = boldsign.Rectangle(x = 50, y = 50, width = 100, height = 150)
)
],
privateMessage = "This is private message for signer"
)
]
)
document_created = document_api.send_document(send_for_sign)<?php require_once "vendor/autoload.php";
use BoldSign\Configuration;
use BoldSign\Api\DocumentApi;
use BoldSign\Model\{FormField, Rectangle, DocumentSigner, SendForSign, DocumentInfo, FileInfo};
$config = new Configuration();
$config->setHost("https://api.boldsign.com");
$config->setApiKey('YOUR_API_KEY');
$document_api = new DocumentApi($config);
$form_field = new FormField();
$form_field->setName('Sign');
$form_field->setFieldType('Signature');
$form_field->setPageNumber(1);
$form_field->setFont('Helvetica');
$form_field->setIsRequired(true);
$bounds = new Rectangle([50, 50, 100, 150]);
$form_field->setBounds($bounds);
$document_signer = new DocumentSigner();
$document_signer->setName('Hanky');
$document_signer->setEmailAddress('hankyWhites@cubeflakes.com');
$document_signer->setSignerType('Signer');
$document_signer->setSignerOrder(1);
$document_signer->setFormFields([$form_field]);
$document_signer->setAuthenticationType('EmailOTP');
$document_signer->setPrivateMessage('This is private message for signer');
$send_for_sign = new SendForSign();
$documentInfo = new DocumentInfo();
$documentInfo->setTitle('Document SDK API');
$documentInfo->setDescription('Testing document from SDK integration test case');
$send_for_sign->setDocumentInfo([$documentInfo]);
$files = new FileInfo();
$files = 'YOUR_FILE_PATH';
$send_for_sign->setFiles([$files]);
$send_for_sign->setTitle('SDK Document Test case');
$send_for_sign->setSigners([$document_signer]);
$document_created = $document_api->sendDocument($send_for_sign);ApiClient client = Configuration.getDefaultApiClient();
client.setBasePath("https://api.boldsign.com");
client.setApiKey("YOUR_API_KEY");
DocumentApi documentApi = new DocumentApi(client);
FormField formField = new FormField();
formField.setName("Sign");
formField.setFieldType(FormField.FieldTypeEnum.SIGNATURE);
formField.setPageNumber(1);
formField.setFont(FormField.FontEnum.HELVETICA);
formField.setIsRequired(true);
Rectangle bounds = new Rectangle().x(100f).y(100f).width(100f).height(50f);
formField.setBounds(bounds);
DocumentSigner signer = new DocumentSigner();
signer.setName("Hanky");
signer.setEmailAddress("hankyWhites@cubeflakes.com");
signer.setSignerOrder(1);
signer.setSignerType(DocumentSigner.SignerTypeEnum.SIGNER);
signer.setFormFields(Arrays.asList(formField));
signer.setAuthenticationType(DocumentSigner.AuthenticationTypeEnum.EMAIL_OTP);
signer.setPrivateMessage("This is private message for signer");
SendForSign sendForSign = new SendForSign();
File file = new File("YOUR_FILE_PATH");
sendForSign.setFiles(Arrays.asList(file));
sendForSign.setSigners(Arrays.asList(signer));
sendForSign.setTitle("Document SDK API");
DocumentCreated documentCreated = documentApi.sendDocument(sendForSign);import { DocumentApi, DocumentSigner, DocumentInfo, FormField, Rectangle, SendForSign } from "boldsign";
import * as fs from 'fs';
const documentApi = new DocumentApi("https://api.boldsign.com");
documentApi.setApiKey("YOUR_API_KEY");
const bounds = new Rectangle();
bounds.x = 100;
bounds.y = 50;
bounds.width = 100;
bounds.height = 100;
const formField = new FormField();
formField.name = "Sign";
formField.fieldType = FormField.FieldTypeEnum.Signature;
formField.font = FormField.FontEnum.Helvetica;
formField.pageNumber = 1;
formField.isRequired = true;
formField.bounds = bounds;
const documentSigner = new DocumentSigner();
documentSigner.name = "David";
documentSigner.emailAddress = "david@cubeflakes.com";
documentSigner.signerOrder = 1;
documentSigner.signerType = DocumentSigner.SignerTypeEnum.Signer;
documentSigner.formFields = [formField];
documentSigner.authenticationType = DocumentSigner.AuthenticationTypeEnum.EmailOtp;
documentSigner.privateMessage = "This is private message for signer";
const files = fs.createReadStream("YOUR_FILE_PATH");
const sendForSign = new SendForSign();
const documentInfo = new DocumentInfo();
documentInfo.title = "SDK Document Test case";
documentInfo.description = "Testing document from SDK integration test case";
sendForSign.documentInfo = [documentInfo];
sendForSign.title = "Document SDK API";
sendForSign.signers = [documentSigner];
sendForSign.files = [files];
const documentCreated = documentApi.sendDocument(sendForSign);More guides on signer authentication
BoldSign guides go deeper on each method and related features.
- Guide
Signer authentication explained: OTPs, access codes and IDV
How each method works and when teams use it.
Read the guide - Guide
KBA authentication: verify signers without an ID upload
A recap of the KBA webinar.
Read the recap - Page
Bulk send
One document to many signers, each with their own check.
See the page - Page
Multi-channel delivery
Send signing requests by email, SMS, or WhatsApp.
See the page
Security and procurement documents for eSignature
IT and procurement teams can read BoldSign’s security policy, data processing agreement, and subprocessor list online. They can also request the SOC 2 Type 2 report.
- Sign-in
Single sign-on and user provisioning
Works with Microsoft Entra ID.
See features by plan - Audit report
SOC 2 Type 2 report
Available on request from BoldSign.
Request the SOC 2 report - Data protection
Data processing agreement
Includes the EU Standard Contractual Clauses and the UK Addendum by reference.
Read the data processing agreement - Data protection
Subprocessor list
Every third party BoldSign uses to process data.
See the subprocessor list - Service
Service level agreement
Uptime, support response times, and service commitments.
Find it in the Legal Center
Switching from another eSignature tool
Docusign templates import into BoldSign at no charge with BoldSign’s import tool, and BoldSign support helps teams make the switch.
- Guide
Import your Docusign templates
Step-by-step help for moving Docusign templates into BoldSign.
Read the import guide - Comparison
BoldSign compared with Docusign
Features and prices side by side, for teams moving from Docusign.
See the Docusign comparison - Comparison
BoldSign compared with Dropbox Sign
For teams moving from Dropbox Sign, formerly HelloSign.
See the Dropbox Sign comparison - Comparison
BoldSign compared with Adobe Acrobat Sign
For teams moving from Adobe Acrobat Sign.
See the Adobe comparison - Comparison
BoldSign compared with PandaDoc
For teams moving from PandaDoc.
See the PandaDoc comparison - Comparison
SignNow and other tools
Every eSignature tool BoldSign is compared with.
See all comparisons
Frequently asked questions
What is signer authentication in eSignatures?
A check a signer must pass before they can open and sign a document. BoldSign offers 5: email OTP, SMS OTP, access code, KBA, and ID verification.
Can I sign contracts using SMS verification?
Yes. With BoldSign SMS OTP, the signer gets a one-time code by text and enters it to open the contract.
Which signer authentication method should I use?
In BoldSign, email OTP or an access code confirms access, and SMS OTP ties the check to a phone. KBA or ID verification confirms identity.
Is signer authentication free in BoldSign?
Email OTP and access code are free on every BoldSign plan. SMS OTP ($0.20 per SMS), KBA ($1.50 per attempt), and ID verification ($2 per attempt) are pay-as-you-go add-ons from the Business plan.
What is the difference between signer authentication and identity verification?
Signer authentication verifies the signer before they get access to a document, to guard against fraud. Identity verification is one type of signer authentication: the signer proves who they are with a government ID and a live selfie.
Can I add authentication after sending a document?
Yes. In BoldSign you can add a check to a signer after sending, from the document’s overview page or through the API.
Choose the check each signer needs
Start a 30-day BoldSign free trial with no credit card needed, or book a walkthrough.
Last updated: October 15, 2026