Authentication and Identity

Authentication and identity

Your account provides access to workspace features. Signing invitations use a separate recipient flow; see Sign an Agreement.

Profile and timezone

Open the user menu → Profile. Review your name and contact information, change the available profile settings, and save. Set the timezone you want used for displayed dates. API timestamps generally use ISO 8601; the web interface formats dates for the relevant profile timezone. Check the displayed timezone when interpreting a deadline or audit event.

An email change has a separate verification flow. Follow the message sent to the new address and confirm the change before relying on it for notifications.

Change or reset your password

When signed in, use the password change form in Profile and supply the requested current and new password information. When locked out, select Forgot password? on Sign in, enter your email, and follow the reset email. Never share the reset link.

Registration passwords require 8–128 characters with uppercase, lowercase, numeric, and special characters. Choose a unique password. See Getting Started.

Enable authenticator MFA

Multi-factor authentication adds an authenticator-app code to workspace sign-in.

1. Open user menu → Security.
2. Choose Setup Authenticator App.
3. Scan the displayed QR code with your authenticator, or use the manual setup option if offered.
4. Enter the current six-digit authenticator code.
5. Choose Verify Code & Enable MFA.
6. Confirm that Security reports MFA enabled.

The setup QR code and manual secret are credentials. Do not screenshot or share them. Keep the authenticator available before ending your session. If codes fail, check your device's automatic time setting and try a current code.

Eligible administrators can manage organization MFA enforcement in Security. Confirm all affected colleagues have a way to complete setup before enforcing it. Disabling MFA may be unavailable when organization policy requires it.

Session preferences and sign-out

Open /settings/session for the preferences exposed by your deployment. Session duration and single-session controls can affect when you are asked to sign in again. Save changes and read any message describing when they apply. Sign out when finished on a shared device.

If a session expires while preparing a draft, sign in again and reopen the agreement to check what was saved. Do not assume every unsaved field or edit persisted.

Account deletion

The application includes an account-deletion flow. Review ownership, retention, and organization responsibilities before using it. Account deletion is different from archiving an agreement or removing a workspace member.

Authentication for integrations

Document and webhook APIs use a bearer token with the required access. API client registration creates a binding; the inspected code does not implement a client-credentials token endpoint or API client secret rotation route. Coordinate approved token provisioning with the deployment operator. See API Quick Start and Feature Availability.