Secure public access and e-signing

Sign a Delivery Note on the public page

Capture the recipient’s one-time drawn signature through the code-backed public workflow. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.

Audience: Delivery recipientsPermission: Valid token for an open noteModule v1.0.0
Jump to steps
Where to goSecure public Delivery Note link → Signature area → Confirm Delivery

What you’ll accomplish

Capture the recipient’s one-time drawn signature through the code-backed public workflow. This guide follows the supplied Delivery Note module’s live hooks, controller actions, model rules, views and stored side effects.

Follow these steps

  1. Check all delivery details and items.
  2. Draw a signature in the canvas using mouse, touch or pointer input.
  3. If required, use Clear and redraw.
  4. Select the confirmation button once.
  5. Wait for the page to reload as a sealed signed document.
  6. Check the signed confirmation email when Recipient Email was stored.

Fields and options to review

  • HTML canvas powered by Signature Pad 4.0.0 from the configured CDN
  • Hidden signature field receives a data-URI image
  • CRM CSRF hidden field is included when available
  • Canvas intrinsic size: 500 × 220 pixels with responsive display sizing

Rules the system enforces

  • The browser blocks submit when the pad is empty.
  • The server also rejects an empty signature.
  • The current public form does not ask for signatory name or email.
  • The first accepted signature changes status to signed and prevents another signature.
  • The active model checks that signature content is non-empty but does not independently validate the data-URI prefix, image type or dimensions; the supported browser flow must remain the only public signing interface.

How to confirm it worked

  • The note is sealed with signature image, timestamp, IP, user agent and a SHA-256 signature hash.

Safety checks and troubleshooting

  • Sign only after checking quantities and recipient details; the signed note cannot be edited or voided.
Stay within the supported flowDo not force database values, expose secure tokens, bypass permission checks, replace a stored signature or invent a status or interface that the supplied code does not implement.