What Is OTP Verification?
Before a signer can access and sign a document, DottSign requires them to verify their identity using a One-Time Password (OTP), a 6-digit code sent to their email or phone number.
This step ensures that:
- The person signing is the same person who received the invitation
- No one can sign on someone else's behalf without access to their inbox or phone
- The audit trail is legally defensible, the signature is tied to a verified identity
How It Works
For Email Signers
- The signer opens the signing link from their email invitation.
- DottSign sends a 6-digit OTP to the same email address where the invitation was sent.
- The signer enters the OTP in the verification screen.
- Once verified, the document opens for review and signing.
For WhatsApp Signers
- The signer opens the signing link from their WhatsApp message.
- DottSign sends a 6-digit OTP via WhatsApp to the same number.
- The signer enters the OTP.
- The signing flow proceeds normally.
OTP Code Details
| Property | Value |
|---|---|
| Code length | 6 digits |
| Expiry time | 10 minutes |
| Resend | Click Resend code at any time after the code expires |
If the code expires, the signer can click Resend code at no cost to get a new one.
Why Can't OTP Be Disabled?
OTP verification is a required step for all DottSign contracts. It cannot be bypassed or disabled.
This is intentional: electronic signature regulations in Brazil (MP 2.200-2), the EU (eIDAS), and the USA (ESIGN Act) require that a signature be attributable to a specific person. The OTP step, combined with the signer's email address, IP address, device fingerprint, and timestamp, forms the proof of intent required for legal validity.
Removing OTP would reduce the legal strength of the signature.
What Appears on the Audit Trail?
Every OTP verification event is recorded in the signed document's audit trail certificate, which is embedded in the final PDF. The certificate includes:
- ✅ Signing invitation sent to
[email address] - ✅ OTP verification code sent at
[timestamp] - ✅ OTP verification completed from IP
[IP address] - ✅ Signature applied at
[timestamp] - ✅ Document finalised at
[timestamp]
This certificate can be exported and used as legal evidence in the event of a dispute.
Common Issues with OTP
"I didn't receive the OTP email"
- Check your Spam and Promotions folders
- Wait 1–2 minutes, email delivery can occasionally be delayed
- Click Resend code on the verification screen
- If you still don't receive it, contact the person who sent you the contract, they can resend the invitation with a fresh link
"The code says it's already expired"
OTP codes are valid for 10 minutes from the moment they are sent, not from when you open the email. Click Resend code to get a fresh code and enter it immediately.
"I entered the code incorrectly"
Request a new OTP by clicking Resend code and enter the fresh code immediately.
"The signer received the OTP but can't complete the verification"
Make sure they are entering the code in the same browser session where they opened the signing link. Opening a new browser tab or a private window after receiving the code may cause the session to be lost.