How clients sign in

Whenever you send a client something private, a shared document, a document to sign, an invoice to pay, a form filled in for them alone, or a meeting page, Esqase asks that person to prove who they are before the page opens. This page explains where your clients sign in, the two ways they can do it, why they usually only do it once, and the account Esqase keeps for them. The other pages in this section link here rather than repeating it.

One rule matters more than the rest, and it is worth knowing before you read anything else: having an Esqase account grants a client nothing on its own. What they can open is still decided entirely by the email address you sent the link to.

Before you begin

• There is nothing for your firm to turn on. Sign-in is part of every restricted link you send. You do not configure it, and you cannot switch a client to one method over another.
• The email you put on the record is the key. A client is let in when the address they sign in with matches the address on the record you shared: the recipient on a document share, the signer on a signature request, the billing contact on an invoice, a contact on the form's matter, or a guest on the meeting. Check that address before you send the link, because it is the only thing that decides access.
• Sign-in only appears on restricted links. A public document share (Anyone with the link) and a public lead-intake form open straight away, with no sign-in at all. See How clients view shared documents and How clients fill intake forms.

Where clients sign in

Clients sign in in two places: the Esqase client portal on the web, and the Esqase Client app on their phone. Both use the same account. Invoices, documents, forms and meeting pages never ask a client to set up anything of their own. When one of them needs to know who the visitor is, it hands them to the portal, and the portal hands them straight back to the page they were opening. In the app, those pages open already signed in.

That means a client signs in once and is then recognised everywhere: on a payment link, a shared document, a document to sign, a one-time form and a meeting page. It also means a client who is already signed in never sees a sign-in screen at all.

The two ways to sign in

The panel is titled Sign in to Esqase, with the line "Enter your email below to login to your account" underneath. When the client arrived from something you sent, the title is Sign in to continue instead, with one line naming what is waiting ("Sign in to view your invoice", "to open your document", "to open your form", "to open your meeting"). It never names your firm or the document, so a link forwarded by mistake gives nothing away.

There is no password anywhere on a client's Esqase account, and nothing for a client to choose, remember or reset.

Email and a 6-digit code

This is the method the panel opens on, and every client can use it.

1. The client types the email address your firm has on file into the Email field.
2. They click Continue. The button reads Sending code... while Esqase sends the email.
3. Esqase emails a single-use 6-digit code to that address, with the subject Your Esqase sign-in code. The code is good for 10 minutes.
4. The panel changes to the code screen, covered in The code screen below.

The client needs no account and nothing to set up. An address that has never signed in before gets an account automatically, with nothing to fill in.

Continue with Google

Below the Continue button, separated by a line reading Or continue with, is a Continue with Google button. The client clicks it, picks their Google account, and comes straight back to the page they were trying to open. Nothing is asked of them beyond choosing the account, and a Google account with no Esqase account yet simply gets one.

Google sign-in gets a client into their own portal, but it opens what you sent only when the Google account's email address matches the address on the record. A client who signs in with a personal Google address when you addressed the invoice to their work address is turned away, exactly as any other mismatched address would be.

The code screen

Once a client has asked for a code, the panel becomes Check your email, with the line "Please enter the 6-digit code we sent to" and the address printed underneath it. It is laid out exactly like the code screen your own team sees when they verify their email address in Esqase.

1. The client opens the email and reads the six digits.
2. They type them into the six boxes. Esqase submits by itself as soon as the sixth digit lands, and there is a Continue button for anyone who would rather click. It reads Signing you in... while it works.
3. The page opens what the client came for: their portal, or the invoice, document, form or meeting they arrived from.

Two controls sit under the boxes:

• Didn't receive the code? Resend in 30 counts down from thirty seconds and then becomes Resend. Clicking it emails a fresh code, and the previous one stops working straight away.
• Use a different email goes back to the first screen, for a client who typed the wrong address.

If the code is wrong, expired or already used, the panel says We could not sign you in, with the line "That code is incorrect or has expired. Please request a new one." The client asks for a new code and tries again.

Adding a name the first time

A client signing in for the very first time, with no name on their Esqase account yet, sees one short screen titled Complete your profile, reading "Add your name to continue to your portal." with a First name and a Last name field. Esqase fills both in from the contact record your firm holds for that address, so most clients simply click Continue.

The name belongs to the client and to their own portal. It does not rewrite the contact record you hold, and it has no effect on what they can open. See Client account settings.

Signing in without clicking anything

A client who is already signed in does not see the sign-in panel at all. When they open a shared document, a signature request, a payment link, a one-time form or a meeting page, the page shows a spinner and the words Signing you in... for a moment, on a plain screen with nothing else on it, and then opens the document, invoice, form or meeting by itself. There is no button to press and nothing to teach them.

A client who is not signed in is taken to the portal sign-in panel, signs in there with either method, and lands back on the page they were opening. Their browser remembers them from then on, so the next invoice or document you send opens straight away.

When the automatic sign-in does not apply

Two messages are worth recognising, because both are answered the same way.

• "You're signed in to Esqase with a different email address." The client is signed in, but with an address that is not on the record. Underneath the message is the page's own email sign-in form, where they enter the address you sent it to and get a link. They can also sign out of the portal and sign in again with the right address.
• "We couldn't sign you in automatically." Something went wrong on the way back, or the attempt took too long. The same email sign-in form is right below it, and it always works.

Neither message means the link is broken, and neither reveals whether a given address is on the record.

Notices on the sign-in panel

A short line sometimes sits above the Email field explaining why the client has landed there. None of them means anything is wrong with the link you sent.

• "Your session expired. Please sign in to continue." The client's sign-in has run out and they need to do it again. Signing in with a fresh code or with Google puts them straight back where they were.
• "You were signed out for inactivity. Please sign in to continue." The client left the portal open and untouched for an hour.
• "You have been signed out. Please sign in to continue." The client signed out, on this device or from another one.
• "For your security, please sign in again to continue." The client asked to change something on their own account that needs a fresh proof, such as linking Google or signing out other devices. See Client account settings.
• "Your account is scheduled for deletion. Sign in again within 30 days to cancel." The client asked for their Esqase account to be deleted. Signing in cancels it and nothing is lost.
• "We could not sign you in with Google. Please try again." The Google step did not finish. The emailed code works either way.

On the Esqase Client app

The Esqase Client app has its own sign-in screen, with the same emailed code and Continue with Google, and Continue with Apple on an iPhone. After signing in, a client can turn on Face ID, Touch ID or fingerprint sign-in, which also locks the app when they come back to it. A sign-in in the app ends after an hour without use, and after 12 hours in any case. Pages you send, such as a payment link or a document to sign, open inside the app already signed in. Everything about it is on Signing in to the Esqase Client app.

What an account does and does not give a client

This is the part to be clear about if a client, or a colleague, asks whether anyone can sign in.

Having an account grants nothing. It is a way of proving an address, not a key. Anyone can prove an address they own, in the same way anyone can create an email address, and doing so gives them access to no document, no invoice, no form, no meeting, and no matter.

Every restricted link makes the same check, every time, whichever method was used: is this exact address the one the firm sent this to? A document opens only for the recipient you addressed the share to. A signature request opens only for that signer. An invoice opens only for the contact it is billed to. A form opens only for a contact on that record. A meeting page opens only for a guest on that meeting.

A client who signs in with an address you have never heard of gets a single, unhelpful message and no document. They cannot sign their way into somebody else's file.

The portal itself behaves the same way. Anyone who can prove they own an address can sign in, and what they see is whatever your firm (or another firm on Esqase) holds against that address. An account with an address nobody has on file is a valid account that shows an empty portal.

Which methods appear where

Common questions

Do clients have to create an account? No, and there is nothing to fill in. The first time a client proves an address, Esqase keeps an account behind the scenes for it, which is what lets them be recognised on the next link you send.

Can a client use one account with several firms? Yes. One address, one way in, and each firm's documents and invoices open according to the address that firm has on file. A client working with two firms on Esqase signs in once and sees both in their portal.

Do clients have a password we might need to reset? No. There is no password on a client account anywhere in Esqase, so there is nothing to reset, nothing to forget and nothing for your firm to manage. See Passwords and account recovery for the firm side.

Does a client's sign-in give them access to our dashboard? No. Client accounts and firm-member accounts are entirely separate, and a client account cannot sign in to your dashboard at all. See Signing up and signing in for the firm side.

A client says they signed in but the document still will not open. The address they signed in with is not the address on the record. Compare the two, correct the contact if needed, and send a fresh link.

Why do we not see whether a client has an Esqase account? Because it would tell you nothing useful. Access is decided by the email address on your record, not by whether an account exists, so the account is the client's own business. What you can see is that the document was opened, on the record's activity history. See Activity timelines and audit logs.

Troubleshooting

• The client is locked out after several tries. Both sign-in methods are rate limited. After several attempts in a short window the client is asked to wait a few minutes. It clears on its own.
• The client never receives the code. Ask them to check spam, then confirm the address you have on file matches the one they typed exactly. Remember the code screen appears whether or not the address matched, so checking your own record is the reliable test.
• The code is refused as incorrect or expired. Codes last 10 minutes and work once. If the client asked more than once, only the newest code works, so ask them to use the newest email or click Resend.
• The client asked for the code on one device and opened the email on another. The code only works in the browser that asked for it. Ask them to start again on the device they want to use, and to read the code across rather than clicking anything.
• Google sign-in is refused. Either the Google address is not the one on the record, or the client is trying to link a Google account whose address differs from their Esqase account's. Ask them to use the address you have on file, or the emailed code.
• The client signed in but the portal looks empty. Their address is not on any contact record yet. Add it to their contact and ask them to refresh.

Related

• The client portal
• Signing in to the Esqase Client app
• Client account settings
• How clients view shared documents
• How clients sign documents
• How clients pay invoices
• How clients fill intake forms
• How clients book meetings
• Working with contacts