How to use Email OTP authentication with Embedded Signing via API?

Email OTP authentication requires signers to enter a one-time password (OTP) sent to their email address before accessing a document. When used with embedded signing, signers can complete the signing process within your application while still being verified through Email OTP.

Who can use this feature?

This feature is intended for developers who use the BoldSign API and want to:

• Use embedded signing within their application.
• Verify signer identity using Email OTP authentication.
• Track authentication activity in the audit trail.
• Control how signer notification emails are delivered.

Prerequisites

Before you begin, ensure that you:

• Create documents using the BoldSign API.
• Use the Embedded Signing Link API.
• Configure Email OTP as the signer authentication method.

How Email OTP works with embedded signing?

To use Email OTP authentication with embedded signing, recipient emails must remain enabled when the document is sent. This allows BoldSign to deliver the OTP email required for signer verification.

Step 1: Send the document with Email OTP authentication

When creating the document:

• Set DisableEmails=false.
• Set EnableEmbeddedSigning=false.
• Configure Email OTP as the signer authentication method.

The following example demonstrates how to send a document using the Document Send API with the DisableEmails parameter set to false.

curl -X 'POST' \
'https://api.boldsign.com/v1/document/send' \
-H 'accept: application/json' \
-H 'X-API-KEY: {your-api-key}' \
-H 'Content-Type: multipart/form-data' \
-F 'DisableEmails=false' \
-F 'Signers={
 "name": "Hanky",
 "emailAddress": "[email protected]",
 "signerType": "Signer",
 "authenticationType": "EmailOTP",
 "formFields": [
   {
     "id": "signature1",
     "name": "Signature",
     "fieldType": "Signature",
     "pageNumber": 1,
     "bounds": {
       "x": 50,
       "y": 50,
       "width": 100,
       "height": 50
     },
     "isRequired": true
   }
 ],
 "locale": "EN"
}' \
-F '[email protected]' \
-F 'Title=Email OTP Embedded Signing Demo' \
-F 'Message=Please review and sign this document.' 

Step 2: Configure signer notifications

If you do not want signers to receive document invitation emails, configure the recipient notification settings accordingly while ensuring recipient emails remain enabled for Email OTP verification.

Step 3: Generate the embedded signing link

After sending the document:

• Generate an embedded signing link using the Embedded Signing Link API.
• Pass the signing link to your application.
• Open the signing session within your application.

What happens during signing?

When the signer accesses the embedded signing session:

• The signer opens the document using the embedded signing link.
• BoldSign sends an OTP to the signer’s email address.
• The signer enters the OTP to verify their identity.
• The signer completes the signing process.
• The authentication event is recorded in the audit trail.

Limitations

• Email OTP verification emails are not delivered when DisableEmails=true.
• When EnableEmbeddedSigning=true is used, recipient emails are suppressed, preventing Email OTP verification emails from being delivered.
• If invitation emails are disabled, signers must access the document using the embedded signing link.