Kiosk Mode

Kiosk mode is a specialized public signing flow designed for shared devices — a check-in tablet at a front desk, a signing station in a waiting room, or any unattended device that a stream of different signers will use in sequence.

Use this guide to decide when kiosk mode is the right fit, how to enable it, and how its runtime behavior differs from a standard direct link.

When to use kiosk mode

Reach for kiosk mode when:

• The same device will be handed to many different signers back-to-back.
• An operator should be able to protect the kiosk exit/settings control with a PIN.
• The screen should automatically reset if a signer walks away mid-session.
• After completion, the device should return to a welcome screen on its own so it is ready for the next person.

If you just need a single, shareable link that anyone on the internet can open on their own device, use a plain direct link instead. Direct links use /d/TOKEN; kiosk mode uses its own /k/TOKEN URL and can be enabled independently.

Kiosk mode vs. a standard direct link

Both modes create documents from the same template, but they use separate tokens, URLs, recipient-role settings, and welcome messages. Turning one mode off does not disable the other.

Kiosk mode does not support SMS signer authentication. If a template role uses SMS verification, use a standard direct link instead of kiosk mode.

Enabling kiosk mode on a template

Kiosk mode is configured on a template. Open a template and toggle Kiosk mode on. You can then configure:

• Welcome message — optional text shown on the welcome screen between signers. Use it to greet visitors or give instructions.
• Operator PIN — an optional PIN the operator enters to exit kiosk mode. PINs are hashed before storage and are rate limited against brute-force guessing.
• Idle timeout (seconds) — how long the device waits with no activity before resetting mid-session. Accepts values between 30 and 3600 seconds.
• Redirect delay (seconds) — how long the completion screen is shown after a signer finishes before the device returns to the welcome screen. Accepts values between 5 and 120 seconds.

Kiosk mode does not require an active direct link. Disabling the direct link does not disable kiosk mode, and disabling kiosk mode does not disable the direct link.

After kiosk mode is enabled, copy the Kiosk link or click Start Kiosk from the template's kiosk settings. The link opens the dedicated kiosk route and resets the browser session before returning to /k/TOKEN. Kiosk mode is a standalone browser flow; it does not have a separate iframe embed URL.

API-driven setup

Use the template kiosk endpoint to enable kiosk mode:

{
    "recipientRole": "Signer",
    "welcomeMessage": "Welcome to Acme Clinic — please tap to begin",
    "pin": "2468",
    "idleTimeoutSeconds": 120,
    "redirectDelaySeconds": 10
}

• Leaving pin unset on an update preserves the existing PIN.
• idleTimeoutSeconds and redirectDelaySeconds must fall within their allowed ranges (30–3600 and 5–120 respectively).
• Direct-link endpoints only affect direct-link fields. Kiosk endpoints only affect kiosk fields.

See the API Reference for the exact request shape and response.

How kiosk sessions flow at runtime

A kiosk session moves through a predictable cycle:

1. The device sits on the kiosk intake screen between sessions.
2. The signer fills in their details and signs the document.
3. The completion screen appears for the configured redirect delay.
4. The device automatically resets and returns to the kiosk intake screen.

If the signer walks away partway through step 2, the idle timeout resets the session for you — no manual intervention required.

Operator PIN security

• PINs are hashed with the same algorithm used for user passwords; the raw PIN is never stored.
• Failed PIN attempts are rate limited per template. After five incorrect attempts, PIN verification is blocked for 15 minutes.
• Rotate the PIN whenever an operator changes roles. Leaving pin blank while saving kiosk settings preserves the existing PIN; disabling kiosk mode clears the stored PIN.

Idle timeout behavior

While a signing session is open, the device watches for activity (tapping, typing, signing). If no activity is seen for the configured number of seconds, the session is abandoned, the device returns to the welcome screen, and the next signer can start from a clean intake screen.

Set a shorter timeout (30–60 seconds) for busy, high-traffic kiosks where unattended screens are a privacy risk. Set a longer timeout (3–5 minutes) for documents that ask the signer to read carefully before acting.

Redirect delay behavior

After a signer completes a document, the completion screen stays visible long enough to show confirmation, then the device returns to the welcome screen.

• Shorter delays (5–10 seconds) keep the line moving at a busy kiosk.
• Longer delays (20–60 seconds) give the signer time to read any post-signing message or instructions before the screen resets.

Where to go next

• Embed Integration — direct links and embeds.
• Templates — designing the template that backs your kiosk flow.
• Webhooks — reacting server-side to documents created and signed through a kiosk.
• API Reference — exact direct-link and kiosk operations.