Waivers and workflows

A gym or a rental counter does not prepare a document per customer. A workflow does it for them.

A workflow is a published template plus the rules for running it: who signs and in what order, whether the business countersigns, how long a link lives, when to remind, and what the form asks for beyond a name and an email.

Two ways in

• A public page. Give the workflow a public_slug and a participant starts their own document by filling in a form at /f/<your-slug>/<public_slug> on signsealer.com. No API call from you at all. The portal draws the QR code for it (Forms & QR in the dashboard: a page, a PNG, a counter card to print, and a button to paste on your own website), and GET /v1/workflows/:id/qr hands the same code to your own system. The form itself offers the person a code to scan when it is open on a counter tablet, so they can fill it in and sign on their own phone instead.
• An API call. POST /v1/workflows/{id}/start with the participant's details. Use this when your system already knows who is coming.

A signing link on your own website

A form with a public address is a website signing link: a visitor opens it, answers the form's questions, reads the document with their answers in it and signs, and the signed document is yours, under Documents. You set one up in the dashboard under Forms & QR, or from the last step of New template with Make a website signing link, which saves the template and opens the form with the link switched on and the template's blanks already asked as questions.

Before the link goes live

The form's page lists the checks a link has to pass, with the way to fix each one. A save that would put the link live, or keep it live, while one of the first kind fails is refused with that check's sentence, beside the field it is about, and so is switching it back on.

• Must pass: the template is published; every visitor gives their name and email; no box on the document is one only your business fills in when it sends, unless the visitor is asked it (by a question of the form's, or by a blank of the same name in the document's text); a line for your business to sign has somebody on the form who signs for the business; everybody else on the form has a name and an email; and your account can send (it is not closed, and not waiting for you to agree to updated terms). A pause on your sending, which holds messages while we look at something, does not stop a link.
• Said, not stopped: blanks nothing else fills, which are asked as questions of their own (“Will be asked as …”); an optional box only your business fills in, which is left empty; and the email check below, when it is off.

Visitors are turned away only for the template not being published or your account not being able to send, which stopped them before these checks existed: the form's page says it is not ready yet. A link that was live before the checks keeps taking signatures whatever else it fails. The forms list and the form's own page mark it Needs attention and say what to fix; until it is fixed, a change to the form is not saved, and nobody is emailed about it.

The email check

A visitor who signs on the device in front of them first types a six-digit code we email to the address they gave, so you know the address is theirs. A visitor who asks for the link by email proves it by opening that email. One who asks for it by text confirms their number with a code, which proves the number and not the address, so when they open the texted link they type the code we email them too. Until the address is proven, nobody else on the form is sent their link: on a form signed all at once, the others' links go the moment the code is typed (or the emailed link is opened and agreed to), and on one signed in order they wait for their turn as always. Somebody who takes a place from a party link on such a form confirms a code too. An address that asked you to stop emailing it (mail to it bounced, or its owner unsubscribed) cannot be sent the code, so the page says so beside the box and asks for another, and nothing is made; so does a form that emails every visitor (Limits, below).

It is on for a new form with a link, part of the form, and free: it is not the one-time passcodes under Settings, and nothing is counted for it. Turn it off only if the link sits behind your own login, since without it anyone could type anyone's email. A form made before the check keeps working as it did: its link stays live, with the check off until you tick it, and its page says so. A tablet at the counter is not asked.

Limits

Taking signatures, on or off, at the top of the form's page: one tap stops the form, its link and a tablet alike. The limits below are the website link's, shown on a form that has one: a tablet at the counter and the API start the form whatever they say, and the documents those start are not counted.

• Stop after this many signed: the link closes once that many documents started from it are signed. Anybody part-way through can still finish.
• Stop taking signatures after a day: the link closes after it, on the form's own calendar. This is not how long each person's link lasts.
• Somebody who signed recently: off unless you choose it, since a waiver is often signed at every visit. Set to a number of days, the link emails every visitor rather than letting them sign on the page: a link to sign, or, to an address that signed within those days, its signed copy again rather than a new document. The page says the same to everybody, so nobody can learn whether an address signed by typing it. Each of those links is one of your signing links: once you have sent as many as your account allows for now, the form tells every visitor to try again later, and makes nothing.

A closed link says why on its page, before anybody types anything, and the forms list says Link closed by its limits.

Sharing it

Once the link is live, the form's page has it in one place: the link with a Copy button; Try it as a visitor, which opens it in a new tab (use a private window to see exactly what a stranger sees); the QR code, with a counter card to print and a PNG; the button to paste into your website; and, once you have proven your website is yours (a verified signing domain, a company sign-in domain, or a connected app's site), the code that puts the form itself inside one of its pages.

An address

A form's question can be an address: the visitor is asked the street, the city, the state or region and the ZIP or postal code, and the document gets them as one line (“12 Main St, Bend, OR 97701”) where the question's blank is, such as {{address}}. The street, city and ZIP or postal code are needed for a required one, and for an optional one that was begun; the state or region may be left empty, for a country without one.

Sending them back afterwards

Either way in takes a way back: return_url on the start, or ?return= on the public page's address. Once they have signed, the page offers a button back to it — "Back to shop.example" — so the person who came from an order lands on the order, and the person who came from a form lands on the page it was on.

It is honored on exactly three kinds of host, because anything else would be an open redirect with a signature on the end of it: a signing domain you have verified, a company sign-in domain you have proven, or the site an application you connected lives on — the redirect address it registered, since the consent flow completed there. A subdomain of the first two counts. It must be https. Anything else is refused with a 422 that says so, and no document is made. The check runs again when the signed page reads it, so a domain that stops being proven stops being somewhere we send people.

What comes back

The document id and one token per signer — the participant's and every fixed role's — so you can hand the participant straight on to theirs rather than making them wait for an email.

{
  "document_id": "…",
  "title": "Liability waiver — Dana Reyes",
  "expires_at": "2026-10-15T00:00:00Z",
  "signers": [
    { "signer_id": "…", "email": "dana@example.signsealer.com", "participant": true, "token": "…" }
  ]
}

How long a signature stays good

A waiver signed once a year is only useful if somebody can tell, on the day, whether this person's year has run out. Set the period on the template in the dashboard (Templates → How long it lasts), to match what the document's own wording says. The wording is what binds; the period is how the engine reads it. Every signed document then carries standing and valid_until on GET /v1/documents, GET /v1/documents/:id and the gate's GET /v1/documents/:id/signers:

• current: inside its period.
• expired: past it; the person signs again.
• resign: signed on a version the business has since asked everybody to sign again, because the terms changed.
• renewed: the same person has signed the template again since. This one is history, not a problem.
• on_file: signed, and the template has no period.

Before a check-in, ask for one person by their email or phone:

GET /v1/standing?template=liability-waiver&email=dana%40example.com

{ "template": "liability-waiver", "found": true, "document_id": "…",
  "signed_at": "2026-10-03T14:22:09Z", "template_version": 2,
  "standing": "current", "valid_until": "2027-10-03T14:22:09Z" }

found: false means they have never signed it: send them the form. The period is read when you ask, not stamped on the document, so waivers signed before the period was set are judged by it too. With a reminder set, each signer is emailed the business's public form a chosen number of days before theirs runs out, once.

One person, two roles

A signer role with "self": true is the participant again in a second role — a sole proprietor signing for the business and again as the personal guarantor, a parent for themselves and as guardian. The engine makes a second signer at the same address, named with the role's label after the person's name, emailed its own link rather than handed on, and in a sequential workflow that link refuses a signature until the earlier one is in. The two-party demo runs on it. Neither the API nor the dashboard's workflow editor can set it yet; to have one person sign twice over the API, send them as two signers at two steps (Signers, roles and order).

Fields beyond a signature

A template can require initials, a checkbox, a date or a photo, and the requirement travels with the template — it freezes when the template is published, because what you were asked to initial is part of what you agreed to.

A per_child requirement becomes one row per covered minor, named. A guardian initialling once for three children is not the same act as initialling three times, and a court asked which child a release covered should not be told "the template said per child".