Skip to content

docs(turbosign): say embedded verification is recommended, not enforced #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amitsharma-turbodocx merged 1 commit into from
Oct 21, 2026
Merged

docs(turbosign): say embedded verification is recommended, not enforced #218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/TurboSign/embedded-signing/build/_setup-and-verify.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
An admin must have completed [Set up your organization](../set-up-your-organization.md): **Enable identity verification** is on (it is the master switch for embedded signing), and your app's origin is under **Allowed embedding domains**.

This guide verifies each signer with an **email passcode**. Every embedded signer needs a verification method unless you use the sender override while testing. To use SMS, your own identity provider, or the override, see [Identity verification](../../identity-verification/index.md).
This guide verifies each signer with an **email passcode**. Give every embedded signer a verification method. TurboSign does not enforce this: with no verification, and an organization that verifies only when requested, it still issues a reusable link that anyone holding it can use (see [A recipient with no verification is unprotected](../../identity-verification/index.md#signers-in-your-own-app-embedded-signing)). To use SMS, your own identity provider, or the override, see [Identity verification](../../identity-verification/index.md).
6 changes: 5 additions & 1 deletion docs/TurboSign/embedded-signing/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,11 @@ Every embedded signing integration makes the same four moves:

## Choose how signers verify

Every embedded signer needs a verification method, unless you use the sender override while testing. Your app shows the signing page itself and TurboSign emails no link, so a check is what ties the person at the screen to the signer of record.
Give every embedded signer a verification method. Your app shows the signing page itself and TurboSign emails no link, so a check is what ties the person at the screen to the signer of record.

:::caution TurboSign does not enforce this
If you set no verification on a signer and your organization verifies only when requested, TurboSign still issues a reusable signing link, and anyone holding it can sign. If your organization verifies on every signature request, the signer gets your organization's default method instead. See [A recipient with no verification is unprotected](../identity-verification/index.md#signers-in-your-own-app-embedded-signing).
:::

| Method | Who verifies the signer | Signing URL |
|---|---|---|
Expand Down
Loading