---
key: set-how-customers-sign-agreements
title: Set how customers verify themselves and sign agreements
audience: staff
section: settings
routes: ["/settings/org/agreements"]
permissions: ["agreements.settings.manage"]
features: ["settings.org.agreements"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Choose how a customer proves who they are before signing, whether signing links can be reused, and the rules for uploaded PDF agreements such as date filling and downloads.
keywords: [e-signature, sign link, one-time code, identity check, uploaded PDF, signing security, verification, esign]
related: [set-agreement-branding-and-reminders, set-agreement-retention-and-signing-services, sign-in-to-the-portal]
---

In the sidebar, open **Settings**, then choose **Agreement Settings** under **Agreements**. The page address is `/settings/org/agreements`. This article covers **External signer auth defaults** and **Uploaded PDF signing policies**.

These are the organization's defaults, applied whenever a customer is invited to sign.

## Before you start

- Your role needs permission to manage agreement settings.
- The **Uploaded PDF signing policies** section only unlocks when uploaded-PDF agreements are in your plan; otherwise it shows **Entitlement required**.
- Everything saves with the one **Save settings** button at the top of the page.

## Steps

1. Under **External signer auth defaults**, choose **How customers sign in**: **Email link (Recommended)** sends a secure link and is right for most one-off signers; **Email OTP (Step-up)** and **SMS OTP (Step-up)** add a one-time code, which today arrives by email for both, so the signer needs an email address; **Portal login (Repeat signers)** asks the customer to sign in to the portal, so the signer must be linked to a customer or contact.
2. Switch on **Require an extra identity check** only for sensitive agreements. When it is on, list at least one method in **Extra identity checks**, separated by commas, for example "email, sms". Today the extra check is always a code sent by email.
3. Leave **Allow links to be reused** off unless customers genuinely need to reopen the same link.
4. Switch on **Allow other finish buttons by default** if the last step should offer choices like Acknowledge or Approve instead of only Sign.
5. Under **Uploaded PDF signing policies**, set **How customers sign in** for uploaded PDFs. **Inherit external signer policy** uses the choice above and is usually right.
6. Choose **How dates get filled in**: **Manual entry only**, **Agreement defaults**, **Signer profile** or **System signed date**.
7. Set **Downloading the original PDF** and **Downloading the signed PDF** to **Allow with org permission** or **Disable operator downloads**.
8. Choose **Who can edit the form boxes**: **Signer editable**, **Sender locked** or **Autofilled and read-only**.
9. Press **Save settings**.

## What you see

- The summary strip near the top shows **External auth** with the verification policy in effect and **Uploaded PDF** with its status.
- Under **Operational posture**, **External signer policy** repeats the saved choice.

## If something looks different

- Saving fails with a message about second-factor methods: **Require an extra identity check** is on but **Extra identity checks** is empty. Add at least one method.
- A note stands in for the uploaded PDF fields and the badge reads **Entitlement required**: that kind of signing is not in your plan.
- You want reminders or branding instead: see [[set-agreement-branding-and-reminders]].

[[route:/settings/org/agreements|Open Agreement Settings]]