> ## Documentation Index
> Fetch the complete documentation index at: https://docs.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Requiring email verification on shared links

> Require recipients of a public shared link to verify their email address with a one-time passcode (OTP) before they can access your content.

Email verification adds an identity check to a public (**People with the link**) [shared link](/en/box-fundamentals/for-users/collaborating/using-shared-links/creating-shared-links.md). When you turn it on, anyone who opens the link must prove their identity by verifying their email address with a one-time passcode (OTP) before they can view or download your content. This ties every access event to a verified email address, so both you and your administrators know exactly who opened the link. You can verify any recipient, or limit access to the email addresses and domains on the link's Access List.

Email verification is available on Business plans and above at no additional cost.

## When to use email verification

Public shared links are a frictionless way to share content, but once a link is sent, it can be forwarded, leaked, or discovered. Password protection helps, but a password can easily be forwarded along with the link. Email verification closes that gap by tying access to an individual, verified email address.

Use email verification when you want assurance about who is accessing content shared through a public link. Use it instead of a password when you need a verifiable record of each recipient.

The following table compares the two options:

| | Password protection | Email verification (OTP) |
| - | - | - |
| **Identity verification** | No. Anyone with the password can access the content. | Yes. Access is tied to a verified email address. |
| **Audit trail** | Confirms only that someone entered the correct password. | Confirms exactly which email address accessed the link. |
| **Sharing risk** | The password can be forwarded along with the link. | The verified email address is individual and can't be transferred. |
| **Recipient effort** | Recipients must obtain and enter the password. | Signed-in Box users: none. Anonymous recipients: enter an email address and a code. |

> [!NOTE]
>
> Email verification and password protection are mutually exclusive. A shared link can use one or the other, but not both. When you turn on **One-Time Passcode protection**, **Password protection** turns off automatically, and the other way around.

## Verification modes

When you require email verification, choose one of two modes:

* **Anyone with an email**: Any recipient can access the link after verifying their email address. Use this mode when you're sharing broadly but still want a record of who accessed the content, without listing recipients in advance.
* **Only people added to the link's Access List**: Only recipients whose email address matches the link's Access List can access the link. Use this mode when access should be limited to specific people or organizations. You can add individual email addresses, such as `user@example.com`, and whole domains, such as `example.com`.

In both modes, people who are already signed in to Box are recognized automatically and are never shown a passcode challenge. This includes collaborators on the file and people using the Box mobile apps or Box Drive. See [What recipients experience](#what-recipients-experience).

## Before you begin

* Your account must be on a Business plan or above.
* The shared link's access must be set to **People with the link**. Email verification isn't available on **People in your company** or **Invited people only** links, because those recipients already sign in to Box.
* Only owners, co-owners, and editors of the item can add, change, or remove email verification.
* Email verification doesn't work on shared links to Box Notes.

## Requiring email verification on a shared link

1. In your Box files view, hover over the file or folder and select **Share**.
2. At the bottom of the **Share** window, confirm the link access is set to **People with the link**. If it's set to anything else, email verification is unavailable.
3. Select **Link Settings**. The **Shared Link Settings** window opens.
4. Turn on **One-Time Passcode protection**. If the link has a password, **Password protection** turns off.
5. Under **After verification, allow access to**, choose a verification mode:
   * Select **Anyone with an email** to let any recipient access the link after verifying their email address.
   * Select **Only people added to the link's Access List**, then select **Configure** and add the email addresses or domains that can access the link. You can add up to 1,000 entries.
6. Select **Save**.

After you save, the **Shared Link Settings** window shows that one-time passcode protection is on, which mode is selected, and, for the Access List mode, the approved email addresses and domains. You can edit the Access List at any time.

> [!NOTE]
>
> You can add email verification to an existing shared link at any time. The requirement takes effect immediately. Every access attempt after you save must be verified, including attempts from people who already had the link.

### Editing or removing email verification

Any owner, co-owner, or editor of the item can change the verification mode, update the Access List, or remove the requirement. To do so, reopen **Link Settings**, make your changes, and select **Save**. Changes take effect immediately for any later access attempts.

> [!WARNING]
>
> When you turn off **One-Time Passcode protection**, or turn on **Password protection**, Box removes the link's Access List. If you turn email verification on again later, add the entries again.

## What recipients experience

The experience depends on whether the recipient is signed in to Box:

* **Anonymous recipients (not signed in to Box)**: Recipients enter their email address, receive a 6-digit code from `noreply@box.com`, and enter that code to access the content. In the Access List mode, they can access the content only if their verified email address matches the Access List. For the full recipient walkthrough and troubleshooting, see [Accessing a shared link that requires email verification](/en/box-fundamentals/for-users/collaborating/using-shared-links/accessing-an-email-verified-shared-link.md).
* **Signed-in Box users and collaborators**: Recipients are never shown a passcode. Box checks their identity automatically. In the **Anyone with an email** mode, they can access the content immediately. In the Access List mode, they can access the content if their email address is on the Access List, and are denied access if it isn't.

After a recipient verifies an email address, the verification is valid for one hour and applies to any link that the address is authorized for during that time. Recipients aren't challenged again while moving between your shared links.

> [!NOTE]
>
> On folder links that require email verification, recipients can't download several items together or download the whole folder. Box displays a success message, but doesn't create or download the ZIP file. Recipients can download each file individually.

## Platform support

The following table shows where you can configure and use email verification:

| Action | Web app | Box mobile apps | Box Drive |
| - | - | - | - |
| Create or change email verification settings | Yes, in **Link Settings** | No | No |
| Access a link that requires email verification | Yes, with a passcode challenge for anonymous recipients | Yes, automatically for signed-in users | Yes, automatically for signed-in users |

Because people using the Box mobile apps and Box Drive are always signed in, they're never shown a passcode challenge. Box grants or denies access automatically based on their identity.

## Related articles

* [Accessing a shared link that requires email verification](/en/box-fundamentals/for-users/collaborating/using-shared-links/accessing-an-email-verified-shared-link.md)
* [Configuring Individual Shared Link Settings](/en/box-fundamentals/for-users/collaborating/using-shared-links/configuring-individual-shared-link-settings.md)
* [Securing Shared Links](/en/box-fundamentals/for-users/collaborating/using-shared-links/securing-shared-links.md)
* [Creating Shared Links](/en/box-fundamentals/for-users/collaborating/using-shared-links/creating-shared-links.md)