Skip to main content
Email verification adds an identity check to public (People with the link) shared links. When a link creator turns it on, anonymous recipients must verify their email address with a one-time passcode (OTP) before they can access the content. This ties every access to a verified email address and gives your organization a verifiable record of exactly who opened each link. This article explains how email verification behaves at the enterprise level, and how to audit and roll it out.

​
Availability and packaging

Email verification is available to users on Business plans and above at no additional cost. It’s included in the existing SKU.

​
How it works

A link creator can require email verification in one of two modes:
  • Anyone with an email: Any recipient can access the link after verifying their email address. This mode is useful when content is shared broadly but identity still needs to be recorded.
  • Only people added to the link’s Access List: Only recipients whose email address matches the link’s Access List of specific addresses or domains can access the link. An Access List can have up to 1,000 entries.

​
Key behaviors

  • Signed-in users are never challenged: Box evaluates authenticated Box users automatically, including collaborators on the file and people using the Box mobile apps and Box Drive. In the Anyone with an email mode, they can access the link. In the Access List mode, Box grants or denies access based on the Access List. Only anonymous web recipients are shown a passcode challenge.
  • Verification is email-based and time-boxed: After an email address is verified, the verification is valid for a fixed one-hour session and applies to any link that the address is authorized for during that time. A single session can hold up to 5 verified email addresses.
  • Mutually exclusive with password protection: A shared link can use email verification or a password, but not both. Turning on one in Shared Link Settings turns off the other.
  • Turning off email verification removes the Access List: When a link creator turns off one-time passcode protection, or turns on a password, Box removes the link’s Access List. To restore access later, the entries must be added again.
  • Not supported for Box Notes: Email verification doesn’t work on shared links to Box Notes.
  • Multi-item and folder downloads don’t complete: On folder links that require email verification, when a recipient downloads several items together or the whole folder, Box displays a success message but doesn’t create or download the ZIP file. Recipients can download each file individually.
For the full link creator and recipient experience, see Requiring email verification on shared links and Accessing a shared link that requires email verification.

​
Enterprise-level behavior

Email verification is a standard shared link option, similar to password protection, available to every user who can create a shared link. It’s enabled by default; your users can use it without any setup in the Admin Console. Note that there’s no enterprise kill switch, so you can’t turn off the option for your users.

​
Auditing verified access

Because access is tied to a verified email address, you get a precise audit trail of who accessed shared content. The Shared Links report shows which links use email verification, and the Shared Links OTP Access List report lists the entries on each link’s Access List. When an anonymous recipient accesses content through a link that requires email verification, the User Activity report, the Access Stats report, and Content Insights show the email address they verified.

​
Enterprise events

The enterprise event stream records the following email verification events:
  • ITEM_SHARED_UPDATE: A link creator turns email verification on or off, changes the verification mode, or changes the Access List. The event includes the mode and the Access List entries before and after the change.
  • SHARED_LINK_ONE_TIME_PASSCODE_ACCESS: Someone opens a link that requires email verification. The event records whether Box granted access, denied access, or asked for a passcode, and why.
  • SHARED_LINK_ONE_TIME_PASSCODE_CHALLENGE: A recipient requests a passcode or enters one. The event records the email address the recipient entered and the outcome, such as a sent code, a successful verification, or an incorrect code.
The PREVIEW and DOWNLOAD events still show anonymous recipients as anonymous users, without an email address. To find out which email addresses accessed a link, use the email verification events.
For event fields and example payloads, see Shared link OTP events in the Box Developer documentation. Email verification events and reports contain the email addresses of recipients, including people outside your organization. Handle this data according to your organization’s privacy and data protection policies.

​
Reference: limits and timers

The following table lists the email verification limits and timers:

​
Configuring email verification with the API

You can set and manage email verification on shared links programmatically with the one_time_passcode shared link field. See Create or update shared link in the Box Developer documentation.

​
Rollout guidance

Before your users start relying on email verification, confirm that your email security tools don’t block or quarantine noreply@box.com, the address that sends passcodes. Box uses the same sender for multi-factor authentication codes, so most organizations already allow it. When you guide users, recommend email verification rather than a password when they need to know who accessed content, because a password can be forwarded along with the link. Also remind link creators who use the Access List mode to keep their lists current. Box denies anyone whose verified email address isn’t listed, and link creators can add individual addresses or whole domains, up to 1,000 entries per link.
Last modified on October 22, 2026