From 9982b52d7a448761faa9793c3e52b032210e3bbf Mon Sep 17 00:00:00 2001 From: Yacine Kahlerras Date: Fri, 9 Oct 2026 12:26:40 +0100 Subject: [PATCH] docs(turbosign): say embedded verification is recommended, not enforced (#215) With no verification on a recipient and an org that verifies only when requested, TurboSign still issues a reusable signing link. Reword the two spots that said every embedded signer needs a method, add a caution, and link to the identity-verification warning that already says so. Co-Authored-By: Claude Opus 5.5 --- docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx | 2 +- docs/TurboSign/embedded-signing/index.md | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx b/docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx index d8535a55..2adbe502 100644 --- a/docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx +++ b/docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx @@ -1,3 +1,3 @@ An admin must have completed [Set up your organization](../set-up-your-organization.md): **Enable identity verification** is on (it is the master switch for embedded signing), and your app's origin is under **Allowed embedding domains**. -This guide verifies each signer with an **email passcode**. Every embedded signer needs a verification method unless you use the sender override while testing. To use SMS, your own identity provider, or the override, see [Identity verification](../../identity-verification/index.md). +This guide verifies each signer with an **email passcode**. Give every embedded signer a verification method. TurboSign does not enforce this: with no verification, and an organization that verifies only when requested, it still issues a reusable link that anyone holding it can use (see [A recipient with no verification is unprotected](../../identity-verification/index.md#signers-in-your-own-app-embedded-signing)). To use SMS, your own identity provider, or the override, see [Identity verification](../../identity-verification/index.md). diff --git a/docs/TurboSign/embedded-signing/index.md b/docs/TurboSign/embedded-signing/index.md index 652bf167..ee070132 100644 --- a/docs/TurboSign/embedded-signing/index.md +++ b/docs/TurboSign/embedded-signing/index.md @@ -49,7 +49,11 @@ Every embedded signing integration makes the same four moves: ## Choose how signers verify -Every embedded signer needs a verification method, unless you use the sender override while testing. Your app shows the signing page itself and TurboSign emails no link, so a check is what ties the person at the screen to the signer of record. +Give every embedded signer a verification method. Your app shows the signing page itself and TurboSign emails no link, so a check is what ties the person at the screen to the signer of record. + +:::caution TurboSign does not enforce this +If you set no verification on a signer and your organization verifies only when requested, TurboSign still issues a reusable signing link, and anyone holding it can sign. If your organization verifies on every signature request, the signer gets your organization's default method instead. See [A recipient with no verification is unprotected](../identity-verification/index.md#signers-in-your-own-app-embedded-signing). +::: | Method | Who verifies the signer | Signing URL | |---|---|---|