## What a token adds

A token is a code used during signing to authenticate access to the configured channel. Receiving it by email, SMS or WhatsApp adds a confirmation step; it does not automatically turn the process into documentary identity verification.

Choose a channel based on the document, risk and how your customer communicates. No single channel is best for every case. The experience must also work for someone signing on a phone or not checking an email inbox daily.

## Start with accurate contact details

Verify the email address and phone number before sending. A token sent to an incorrect contact does not correct a registration error. Tell the person to use the code in the signing flow and not share it with third parties or attendants.

When creating an envelope, select options allowed by the plan and enabled for the account. Invitation, reminder and authentication channels can serve different purposes and conditions. SMS and WhatsApp involve additional consumption; include that usage when estimating the workflow.

## Match the layer to risk

Confirming access to a phone does not, on its own, establish card ownership, representation authority or the absence of fraud. For processes needing identification, assess KYC as a separate layer without confusing results.

Compare [Signature plans](/en/sign/pricing) and explore [KYC](/en/kyc). Also define what your operation does when a person cannot receive a code: exception handling should preserve the process requirements rather than silently bypass authentication.