Multiple Authentication Methods

You can combine multiple authentication methods in a ceremony to create layered authentication workflows. This provides flexibility in how recipients access and authenticate for signing ceremonies.

​

Authentication Order Rules

SignatureAPI enforces specific rules for combining authentication methods:

The table below shows which authentication methods you can use as the first step or as a secondary (or later) step in a ceremony. Use this as a quick reference when designing your authentication workflow.

• First Step Allowed: You can use this method as the initial authentication step.
• Second Step and Up Allowed: You can use this method after another authentication method (as a secondary or later step).

​

Common Combinations

​

Custom + Email Code

Combine custom authentication with email code for enhanced verification.

Use case: When you want to authenticate the signer in your own application, and also require SignatureAPI to independently verify the signer’s identity (by sending a verification code to their email).

// POST https://api.signatureapi.com/v1/recipients/{recipient_id}/ceremony
// X-API-Key: key_test_...
// Content-Type: application/json

{
    "authentication": [
        {
            "type": "custom",
            "provider": "SuperApp",
            "data": {
                "session_id": "sess_12345",
                "authenticated_at": "2024-01-15T10:30:00Z",
                "user_id": "user_67890"
            }
        },
        {
            "type": "email_code"
        }
    ]
}

​

Recipient Experience

​

Email Link + Email Code

Combine email link with email code for enhanced email-based verification.

Use case: When you want SignatureAPI to send the signature request email automatically, but also need to authenticate the recipient’s access inside the ceremony for compliance reasons (e.g., HIPAA requirements).

// POST https://api.signatureapi.com/v1/recipients/{recipient_id}/ceremony
// X-API-Key: key_test_...
// Content-Type: application/json

{
    "authentication": [
        {
            "type": "email_link"
        },
        {
            "type": "email_code"
        }
    ]
}

​

Recipient Experience

​

Best Practices

1. Match Your Use Case: Choose authentication combinations that align with your security requirements and user experience goals

2. Consider User Experience: More authentication steps provide stronger verification but may impact user convenience

3. Test Combinations: Always test the complete authentication flow in test mode before production

​

Limitations

• Custom and email link authentication can only be used as the first method
• Custom and email link authentication cannot be combined together
• Cannot use duplicate authentication methods in the same ceremony
• All authentication methods must be completed in sequence
• Combined authentication requires manual ceremony creation (cannot be used with automatic ceremony creation)

​

Next Steps

• Learn about custom authentication for maximum control
• Explore email code authentication for email verification
• Review ceremony embedding to integrate signing into your application