Verify signer identity

You can require a signer to verify their identity with a CAC/PIV smart card, SMS, or Box login. You can also add a password. Set these on the signer when you create the request, or on a template.

Signer verification options on a signature request

Verification methods

Use verification_method on the signer when you create the request. This is the recommended approach for new integrations.

Type	Description
`cac_piv`	CAC/PIV smart card. Your enterprise must allow this method or the API returns `403 Forbidden`. Multiple signers who use this method must have a signing `order`.
`phone`	SMS verification. Include `phone_number` with a country code prefixed by `+` or `00`, for example `+15551232190`.
`login`	The signer must log in to a Box account. If they do not have an account, they can create a free one.

When you get a request or template, verification_method is null if that signer has no verification. If you set both verification_method and a legacy property such as login_required or verification_phone_number, verification_method takes precedence.

curl -i -X POST "https://api.box.com/2.0/sign_requests" \
     -H "authorization: Bearer <ACCESS_TOKEN>" \
     -H "content-type: application/json" \
     -d '{
       "parent_folder": {
         "type": "folder",
         "id": "0987654321"
       },
       "source_files": [
         {
           "type": "file",
           "id": "123456789"
         }
       ],
       "signers": [
         {
           "email": "signer@example.com",
           "role": "signer",
           "password": "example-password",
           "verification_method": {
             "type": "phone",
             "phone_number": "+15551232190"
           }
         }
       ]
     }'

Password protection

You can add a password alongside any verification method. Password verification happens before the signer can open the request.

Password prompt before the signer opens the request

SMS verification (legacy)

verification_phone_number is still supported. Prefer verification_method when you create the request. By default, SMS verification happens at the signing step, so the signer can view the request first. Set is_phone_verification_required_to_view to true to require SMS before view.

For more background on signer authentication, see the additional signer authentication support article.

Getting started

Applications & integrations

Identity & access

Using the API

Troubleshooting

Content

Collaboration

Metadata & search

Events & webhooks

Users

Intelligent workflow

E-signatures

Security & compliance

Verification methods

Password protection

SMS verification (legacy)

​Verification methods

​Password protection

​SMS verification (legacy)

Verification methods

Password protection

SMS verification (legacy)