← FlexAPI Documentation / Reference / Signer Authentication

Signer Authentication

When using SIGNiX, there are several options for authenticating each signer. You choose the option with the Service element in each party's MemberInfo in the SubmitDocument call. Whatever method is chosen for a party applies to the entire transaction for that party.

Each option below is described by its authentication behavior, the signing flow the signer experiences, and the XML specifications to deliver. A ($) next to a title marks authentication types that may incur additional costs.

On this page

Before you choose

  • Use the placeholders when identity isn't verified. Send SSN 910000000 (nine digits, no hyphens) and DOB 00/00/0000 for any service that doesn't check identity. Only the identity-checking services need real or specific values.
  • MobileNumber goes after Service. It is required for any SMS-based service. Element order matters in MemberInfo.
  • Demo mode and the SMS code. With Demo set to yes, the one-time code is filled in as 999999 and not checked. Turn Demo off to test the real text-message flow.
  • KBA-ID is for notary transactions only. Don't use it in a normal signing transaction. It requires WorkflowOrder, and the notary must be the last MemberInfo.
  • The choice applies to the whole transaction for that party. You can't change a party's service partway through.
  • Don't build new integrations on the deprecated services. See Deprecated services below.

Services at a glance

AuthenticationService valueExtra costStatus
Password Only or No Password RequiredSelectOneClick or express Current
2 Factor Authentication (OTP via Text or Voice)SMSNoIntent or SMSNoPassword($)Current
KBA-ID (knowledge-based authentication with ID check)KBA-ID-SSN4 (preferred) or KBA-ID($)Current, notary transactions only
ID Verify (credential analysis with face biometrics)IDVerifyBiometric($)Current
Know Your Customer (KYC)KYCNoIntent or express($)Deprecated
KBA - Knowledge-based AuthenticationKBANoIntent($)Deprecated
Email Only with Submitted QuestionsSelectOneClick plus Q1/A1 pairs Deprecated (not recommended)
KYC with Submitted Questionsselect plus Q1/A1 pairs($)Deprecated

Current services

Password Only or No Password Required

Behavior. The signer does not go through another factor of authentication. SSN and DOB are not required.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • creates a Signing Password (SelectOneClick) or no Signing Password (express), and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

NOTE: Using express omits the creation and use of a Signing Password. Access to signed documents on the return link is then not secured other than through email, and the signature appearance is not saved.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN = 910000000
  • DOB = 00/00/0000
  • Service = 'SelectOneClick' (Signing Password) or 'express' (no Signing Password)
Password Only - MemberInfo fragment 
<MemberInfo>

  <!-- ... other MemberInfo elements ... -->

  <!-- No external authentication, so SSN and DOB are not needed. Use the dummy values. -->
  <SSN>910000000</SSN>
  <DOB>00/00/0000</DOB>

  <!-- SelectOneClick: the signer creates a Signing Password.
       express: no Signing Password is created or used. -->
  <Service>SelectOneClick</Service>

</MemberInfo>

2 Factor Authentication (OTP via Text or Voice) ($)

Behavior. The signer is prompted to enter a one-time password code sent to their mobile phone by SMS text message or by voice call.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • receives a text on their mobile phone with a one-time code, and enters the code,
    • creates a Signing Password (SMSNoIntent) or no Signing Password (SMSNoPassword), and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

NOTE: Using SMSNoPassword omits the creation and use of a Signing Password. Access to signed documents on the return link is then not secured by a password, but the signer is required to enter a new one-time password (text code). The signature appearance is also not saved.

NOTE 2: In Demo mode (that is, <Demo>yes</Demo>), the signer sees '999999' automatically entered in the dialog box for the code. In Demo mode, the system ignores the OTP for testing purposes. With Demo mode off, the correct OTP code sent to the mobile device is required.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN = 910000000
  • DOB = 00/00/0000
  • Service = 'SMSNoIntent' (requires creation of a Signing Password) or 'SMSNoPassword' (no Signing Password is created or required)
  • MobileNumber: domestic 10-digit numbers only. International SMS support is available for an additional fee.

International numbers. If international numbers are sent, these format rules apply:

  • All international numbers must start with a '+' (plus) sign and the country code.
  • Do not include the prefix for international dialing (for example, 011).
  • A space may or may not be used after the country code. After that, NO spaces are allowed.
2 Factor Authentication - MemberInfo fragment 
<MemberInfo>

  <!-- ... other MemberInfo elements ... -->

  <!-- No identity checks, so SSN and DOB are not needed. Use the dummy values. -->
  <SSN>910000000</SSN>
  <DOB>00/00/0000</DOB>

  <!-- SMSNoIntent: the signer creates a Signing Password.
       SMSNoPassword: no Signing Password is created or required. -->
  <Service>SMSNoIntent</Service>

  <!-- Domestic 10-digit numbers only. International SMS support is available for an additional
       fee. See the international number formats below. -->
  <MobileNumber>YOUR_MOBILE_NUMBER</MobileNumber>

</MemberInfo>
International MobileNumber formats 
<!-- WRONG: includes the international dialing prefix (011). -->
<MobileNumber>+01154 9 11 3011 ****</MobileNumber>

<!-- WRONG: has a space after the 9, and spaces are not allowed after the country code. -->
<MobileNumber>+54 9 114937****</MobileNumber>

<!-- CORRECT: starts with + and the country code, and a space is used only after the country code. -->
<MobileNumber>+54 9113011****</MobileNumber>

<!-- CORRECT: no spaces at all. -->
<MobileNumber>+549113011****</MobileNumber>

KBA-ID - Knowledge-based Authentication with ID Check ($) - Notary only

NOTE: This authentication method may ONLY be used for notarization transactions. It cannot be used in non-notary scenarios.

Behavior. Required for most states for remote online notarization (RON). The signer goes through external authentication: SSN, name and DOB are required. It confirms the association of the name with the DOB and SSN, confirms whether the person is alive, and runs other checks. The signer must then answer several multiple-choice questions drawn from 30 years of public database information. Finally, the signer is prompted to take a picture of their driver's license or passport for automated analysis.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • enters the last 4 of their SSN and their full DOB (unless SubmitDocument required the signer to enter the full 9-digit SSN),
    • answers public record-based questions,
    • takes pictures of their ID,
    • creates a Signing Password, and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • IMPORTANT: Replace SSN with SSNLast4 if using KBA-ID-SSN4 (preferred). The WorkflowOrder element must also be included.
  • SSN: real data (Production), OR 0000 (Production, if the signer will provide it, for KBA-ID-SSN4), OR 000000000 (Production, if the signer will provide it, for KBA-ID). In Webtest, use "0001" plus 5 random digits, and avoid sequences such as '0001234..' or '0001111…'.
  • DOB: real data (Production), OR 00/00/0000 (Production, if the signer will provide it). In Webtest, use any DOB that makes the person over 18 years old.
  • Service = 'KBA-ID-SSN4' (preferred) or 'KBA-ID' (requires a 9-digit SSN).
KBA-ID-SSN4 - MemberInfo fragment 
<MemberInfo>

  <!-- Required with KBA-ID. -->
  <WorkflowOrder>1</WorkflowOrder>

  <!-- ... other MemberInfo elements ... -->

  <!-- For KBA-ID-SSN4 (preferred), use SSNLast4 in place of SSN. Real data in Production, or 0000
       if the signer will provide it. In Webtest, use 0001 plus 5 random digits. -->
  <SSNLast4>0000</SSNLast4>

  <!-- Real data in Production, or 00/00/0000 if the signer will provide it. In Webtest, use any
       DOB that makes the person over 18 years old. -->
  <DOB>00/00/0000</DOB>

  <!-- KBA-ID-SSN4 (preferred), or KBA-ID, which requires a 9-digit SSN. For KBA-ID, use SSN in
       place of SSNLast4: real data in Production, or 000000000 if the signer will provide it. -->
  <Service>KBA-ID-SSN4</Service>

</MemberInfo>

ID Verify - Credential Analysis with Face (Selfie) Biometrics ($)

Behavior. Can be used for remote online notarization (in certain states) as well as for traditional digital signature transactions. The signer is prompted to take a picture of their driver's license or passport for automated analysis, and is then asked to take a picture of their face several times at different angles. These pictures are compared to the face on the identity credential and must match.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • takes pictures of their ID and face as prompted,
    • creates a Signing Password, and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN = 910000000
  • DOB = 00/00/0000
  • Service = 'IDVerifyBiometric'
ID Verify - MemberInfo fragment 
<MemberInfo>

  <!-- ... other MemberInfo elements ... -->

  <!-- The identity is checked from the ID and face pictures, so SSN and DOB are not needed. Use
       the dummy values. -->
  <SSN>910000000</SSN>
  <DOB>00/00/0000</DOB>

  <Service>IDVerifyBiometric</Service>

</MemberInfo>

Deprecated services

Deprecated. The following authentication options are no longer available for new integrations. The API details are provided for informational purposes only.

Know Your Customer (KYC) ($) - Not available / DEPRECATED

Behavior. The signer goes through external authentication: SSN, name and DOB are required. It confirms the association of the name with the DOB and SSN, and also confirms whether the person is alive and runs other checks.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • enters the last 4 of their SSN and their full DOB (unless SubmitDocument required the signer to enter the full 9-digit SSN, in which case the full SSN is required),
    • creates a Signing Password (KYCNoIntent) or no Signing Password (express), and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN: real data (Production), OR 000000000 (Production, if the signer will provide it). In Webtest, use "0001" plus 5 random digits, and avoid sequences such as '0001234..' or '0001111…'.
  • DOB: real data (Production), OR 00/00/0000 (Production, if the signer will provide it). In Webtest, use any DOB that makes the person over 18 years old.
  • Service = 'KYCNoIntent' (Signing Password) or 'express' (no Signing Password)
KYC (deprecated) - MemberInfo fragment 
<MemberInfo>

  <!-- DEPRECATED. No longer available for new integrations. -->

  <!-- ... other MemberInfo elements ... -->

  <!-- Real data in Production, or 000000000 if the signer will provide it. In Webtest, use 0001
       plus 5 random digits. -->
  <SSN>000000000</SSN>

  <!-- Real data in Production, or 00/00/0000 if the signer will provide it. In Webtest, use any
       DOB that makes the person over 18 years old. -->
  <DOB>00/00/0000</DOB>

  <!-- KYCNoIntent: the signer creates a Signing Password.
       express: no Signing Password is created. -->
  <Service>KYCNoIntent</Service>

</MemberInfo>

KBA - Knowledge-based Authentication Questions ($) - Not available / DEPRECATED

Deprecated. Not available for new integrations.

Behavior. The signer goes through external authentication: SSN, name and DOB are required. It confirms the association of the name with the DOB and SSN, confirms whether the person is alive, and runs other checks. The signer must answer several multiple-choice questions drawn from 30 years of public database information. SIGNiX does NOT recommend this authentication type, but can accommodate it if needed.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • enters the last 4 of their SSN and their full DOB (unless SubmitDocument required the signer to enter the full 9-digit SSN, in which case the full SSN is required),
    • answers public record-based questions,
    • creates a Signing Password, and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN: real data (Production), OR 000000000 (Production, if the signer will provide it). In Webtest, use "0001" plus 5 random digits, and avoid sequences such as '0001234..' or '0001111…'.
  • DOB: real data (Production), OR 00/00/0000 (Production, if the signer will provide it). In Webtest, use any DOB that makes the person over 18 years old.
  • Service = 'KBANoIntent'
KBA (deprecated) - MemberInfo fragment 
<MemberInfo>

  <!-- DEPRECATED. No longer available for new integrations. -->

  <!-- ... other MemberInfo elements ... -->

  <!-- Real data in Production, or 000000000 if the signer will provide it. In Webtest, use 0001
       plus 5 random digits. -->
  <SSN>000000000</SSN>

  <!-- Real data in Production, or 00/00/0000 if the signer will provide it. In Webtest, use any
       DOB that makes the person over 18 years old. -->
  <DOB>00/00/0000</DOB>

  <Service>KBANoIntent</Service>

</MemberInfo>

Email Only with Submitted Questions - Not recommended / DEPRECATED

Deprecated and not recommended. Question and answer pairs such as these may be abused in certain situations, because the submitter or an organization representative can find the answer(s) readily and could possibly authenticate themselves as the signer. SIGNiX does NOT recommend this authentication type unless proper risk mitigation and acceptance discussions have taken place in your organization.

Behavior. The signer does not go through external authentication, but is asked to answer questions provided by the submitting system. SSN and DOB are not required.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • answers the submitter's question(s),
    • creates a Signing Password, and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature.
  3. The signer clicks the "Finish" button.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN = 910000000
  • DOB = 00/00/0000
  • Service = 'SelectOneClick'
  • Question and answer pairs (a maximum of 9) within the MemberInfo element, underneath Service.
Email Only with Submitted Questions (deprecated) - MemberInfo fragment 
<MemberInfo>

  <!-- DEPRECATED and not recommended. No longer available for new integrations. -->

  <!-- ... other MemberInfo elements ... -->

  <!-- No external authentication, so SSN and DOB are not needed. Use the dummy values. -->
  <SSN>910000000</SSN>
  <DOB>00/00/0000</DOB>

  <Service>SelectOneClick</Service>

  <!-- Question and answer pairs, a maximum of 9, within MemberInfo and underneath Service. -->
  <Q1>What is the last name of your best friend?</Q1> <!-- Max length 1000 -->
  <A1>Smith</A1> <!-- Max length 1000 -->

  <Q2>What is the passphrase provided by your agent?</Q2>
  <A2>YOUR_PASSPHRASE</A2>

  <!-- Additional question and answer pairs, if needed. -->

</MemberInfo>

Know Your Customer (KYC) with Submitted Questions ($) - Not available / DEPRECATED

Deprecated and not recommended. Question and answer pairs such as these may be abused in certain situations, because the submitter or an organization representative can find the answer(s) readily and could possibly authenticate themselves as the signer. SIGNiX does NOT recommend this authentication type unless proper risk mitigation and acceptance discussions have taken place in your organization.

Behavior. The signer goes through external authentication: SSN, name and DOB are required. It confirms the association of the name with the DOB and SSN, also confirms whether the person is alive, and runs other checks. The signer is also asked to answer questions provided by the submitting system.

Signing flow.

  1. The signer accepts the Consent (and may open it to read it), then:
    • enters the last 4 of their SSN and their full DOB (unless SubmitDocument required the signer to enter the full 9-digit SSN, in which case the full SSN is required),
    • answers the submitter's question(s),
    • creates a Signing Password, and
    • gains access to the document(s).
  2. The signer clicks on each initial/signature and enters the Signing Password.
  3. The signer finishes after the last mandatory signature.

XML specs. Deliver in the SubmitDocument call for the party (Test and Production):

  • SSN: real data (Production), OR 000000000 (Production, if the signer will provide it). In Webtest, use "0001" plus 5 random digits, and avoid sequences such as '0001234..' or '0001111…'.
  • DOB: real data (Production), OR 00/00/0000 (Production, if the signer will provide it). In Webtest, use any DOB that makes the person over 18 years old.
  • Service = 'select'
  • Question and answer pairs (a maximum of 9) within the MemberInfo element, underneath Service.
KYC with Submitted Questions (deprecated) - MemberInfo fragment 
<MemberInfo>

  <!-- DEPRECATED and not recommended. No longer available for new integrations. -->

  <!-- ... other MemberInfo elements ... -->

  <!-- Real data in Production, or 000000000 if the signer will provide it. In Webtest, use 0001
       plus 5 random digits. -->
  <SSN>000000000</SSN>

  <!-- Real data in Production, or 00/00/0000 if the signer will provide it. In Webtest, use any
       DOB that makes the person over 18 years old. -->
  <DOB>00/00/0000</DOB>

  <Service>select</Service>

  <!-- Question and answer pairs, a maximum of 9, within MemberInfo and underneath Service. -->
  <Q1>What is the last name of your best friend?</Q1> <!-- Max length 1000 -->
  <A1>Smith</A1> <!-- Max length 1000 -->

  <Q2>What is the passphrase provided by your agent?</Q2>
  <A2>YOUR_PASSPHRASE</A2>

  <!-- Additional question and answer pairs, if needed. -->

</MemberInfo>

Back to top

SIGNiX Products

Industries We Serve

Support

©2016 SIGNiX. All Rights Reserved.