Availability: Business and Enterprise plans.
Email code verification sends a 6-digit one-time password to the recipient's email before they can open or sign a document. It works the same way as Text (SMS) code verification — but uses email instead of a phone number, so no phone number is required.
You can configure Email code verification per recipient in any of these places:
Document editor
Send dialog
You can also set it as the default verification method for your workspace, or disable it entirely from Workspace settings.
Enable or disable Email code for your workspace
Note: Only account owners and users with admin permission allowing access to workspace settings can manage verification methods. By default, all verification methods are enabled.
Click the gear icon in the lower-left corner and go to Recipient experience settings.
Under Identity verification settings:
Check or uncheck Email code to make it available (or unavailable) to senders across your workspace.
To make Email code the default for all new documents, select it from the Default verification dropdown.
You can also set the default timing: Ask before opening a document or Ask before signing a document.
Select Save changes when done.
Note: Even when a workspace default is set, senders can override the verification method per recipient on individual documents.
Set up Email code verification for a recipient
Note: You can set up identity verification only in a document — not in a template or form. You can automate setting up identity verification via API.
You can apply Email code verification from the document editor or the send dialog — both open the same E-signature and verification panel.
From the document editor
Open your document in the editor.
Go to File → E-signature and verification.
Under Identity verification, select Email code from the dropdown.
Choose when the verification triggers:
- Ask before opening a document — the recipient must verify before they can view the document
- Ask before signing a document — the recipient must verify before they can finalize their signatureSelect Save changes.
From the send step
In the Send document step, select the three-dot menu next to the recipient's name.
Select E-signature and verification.
Under Identity verification, select Email code and choose a timing option.
Select Done at the bottom right corner.
Note: The panel displays each signer's email address — the verification code will be sent to that address. Make sure it's correct before sending.
Note: The verification timing option is only available for recipients who have at least one field assigned to them (signers).
Recipient experience
When a recipient opens (or goes to sign) a document protected with Email code verification:
They see a prompt stating the document is protected. They select Verify now.
PandaDoc sends a 6-digit one-time password to their email address.
They enter the code in the Enter 6-digit verification code field and select Verify now.
Once verified, they can open or sign the document.
The verification email arrives from PandaDoc and displays the 6-digit code.
Note: The code is valid for 10 minutes. The recipient has 3 attempts to enter the correct code. If the code doesn't arrive or expires, they can select Resend code — there is a 30-second cooldown between resend requests.
Verification events and audit trail
Verification activity is logged automatically:
Latest activity and Timeline on the Home page show both successful and failed verification attempts.
Certificate of completion includes an EMAIL VERIFIED entry:
If Email code verification was used, the timestamp reflects when the recipient passed the code check.
If Email code was not used, EMAIL VERIFIED continues to reflect when the recipient first opened the document — no change to existing behavior.
Set up Email code via Public API
You can configure Email code verification programmatically using these endpoints:
Create a document —
POST /public/v1/documentsUpdate a recipient —
PATCH /public/v1/documents/{id}/recipients/{recipient_id}
Refer to the PandaDoc API documentation for the full request schema.