Kiosk Mode

Kiosk mode is a specialized direct-link flow designed for shared devices — a check-in tablet at a front desk, a signing station in a waiting room, or any unattended device that a stream of different signers will use in sequence.

Use this guide to decide when kiosk mode is the right fit, how to enable it, and how its runtime behavior differs from a standard direct link.

When to use kiosk mode

Kiosk mode builds on top of a direct link. Reach for it when:

• The same device will be handed to many different signers back-to-back.
• An operator (not the signer) should unlock each new session with a PIN.
• The screen should automatically reset if a signer walks away mid-session.
• After completion, the device should return to a welcome screen on its own so it is ready for the next person.

If you just need a single, shareable link that anyone on the internet can open on their own device, use a plain direct link instead. See Embed Integration for the direct link and embed flows.

Kiosk mode vs. a standard direct link

Both modes share the same underlying direct-link token, so signing, webhooks, and the resulting documents behave the same way. Kiosk mode only changes how the device frames and cycles through sessions.

Enabling kiosk mode on a template

Kiosk mode is configured on the template that backs the direct link. Open a template, enable its direct link, and toggle Kiosk mode on. You can then configure:

• Welcome message — optional text shown on the welcome screen between signers. Use it to greet visitors or give instructions.
• Operator PIN — a short PIN the operator enters to start a new session. PINs are hashed before storage and are rate limited against brute-force guessing.
• Idle timeout (seconds) — how long the device waits with no activity before resetting mid-session. Accepts values between 30 and 3600 seconds.
• Redirect delay (seconds) — how long the completion screen is shown after a signer finishes before the device returns to the welcome screen. Accepts values between 5 and 120 seconds.

Kiosk mode requires an active direct link. Disabling the direct link also disables kiosk mode and clears the PIN, welcome message, and timing settings.

API-driven setup

When enabling a direct link through the API, pass the kiosk fields alongside the usual recipientRole:

{
    "recipientRole": "Signer",
    "kioskModeEnabled": true,
    "kioskWelcomeMessage": "Welcome to Acme Clinic — please tap to begin",
    "kioskPin": "2468",
    "kioskIdleTimeoutSeconds": 120,
    "kioskRedirectDelaySeconds": 10
}

• kioskPin is only accepted when kioskModeEnabled is true. Leaving kioskPin unset on an update preserves the existing PIN.
• kioskIdleTimeoutSeconds and kioskRedirectDelaySeconds must fall within their allowed ranges (30–3600 and 5–120 respectively).

See the API Reference for the exact request shape and response.

How kiosk sessions flow at runtime

A kiosk session moves through a predictable cycle:

1. The device sits on the welcome screen between sessions.
2. The operator taps Start and enters the kiosk PIN to unlock.
3. The signer fills in their details and signs the document.
4. The completion screen appears for the configured redirect delay.
5. The device automatically returns to the welcome screen and relocks.

If the signer walks away partway through step 3, the idle timeout resets the session for you — no manual intervention required.

Operator PIN security

• PINs are hashed with the same algorithm used for user passwords; the raw PIN is never stored.
• Failed PIN attempts are rate limited per template. After five incorrect attempts, unlock is blocked for 15 minutes.
• Rotate the PIN whenever an operator changes roles. Toggling kiosk mode off and back on clears the old PIN if you leave kioskPin blank while enabling.

Idle timeout behavior

While a signing session is open, the device watches for activity (tapping, typing, signing). If no activity is seen for the configured number of seconds, the session is abandoned, the device returns to the welcome screen, and the next signer must be unlocked by the operator again.

Set a shorter timeout (30–60 seconds) for busy, high-traffic kiosks where unattended screens are a privacy risk. Set a longer timeout (3–5 minutes) for documents that ask the signer to read carefully before acting.

Redirect delay behavior

After a signer completes a document, the completion screen stays visible long enough to show confirmation, then the device returns to the welcome screen.

• Shorter delays (5–10 seconds) keep the line moving at a busy kiosk.
• Longer delays (20–60 seconds) give the signer time to read any post-signing message or instructions before the screen resets.

Where to go next

• Embed Integration — direct links, embeds, and the underlying iframe flow kiosk mode extends.
• Templates — designing the template that backs your kiosk direct link.
• Webhooks — reacting server-side to documents created and signed through a kiosk.
• API Reference — exact direct-link operations, including the kiosk fields described above.