Understand Letter Manager public token and hash security
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Protect possession-based verification and signature URLs.
Where to goLetter Manager email/PDF/public links
Before you start
- Use an authorised account and confirm the customer, external recipient, template, letter or configuration is the intended one.
- Follow the exact route shown above and verify the stored record, generated file and delivery evidence instead of relying on an alert alone.
What this guide helps you do
Protect possession-based verification and signature URLs. These instructions follow the inspected module’s live hook, route, controller, model, installer, PDF helper and view flow.
Follow these steps
- Send links only to intended recipients.
- Avoid posting public verify or signature URLs in open channels.
- Treat forwarded links as granting access to the associated public page.
- Use server logs and internal records when investigating disclosure.
Fields and options
Action scopeProtect possession-based verification and signature URLs.
Module version1.0.0
Exact routeLetter Manager email/PDF/public links
EvidenceVerify the history row, PDF, email metadata, open evidence, signature, public page, client view or postal fields produced by this flow.
Rules and limits
- unique_code and hash are generated with app_generate_hash.
- The supplied module does not implement expiry, revocation or recipient authentication for these public links.
Check it worked
- The requested letter, template, setting, file or tracking detail is created or updated through the supported route.
- The history row, generated PDF, email/send metadata, public verification, signature evidence, client view or postal display agrees with the action.
- Any warning, missing file or failed send is investigated rather than bypassed.
Security, privacy and operational checks
- Apply least privilege and verify recipient identity before sending or exposing public links.
- Protect PDFs, enclosures, signatures, verification URLs, email-open metadata, IP addresses and customer data under organisational policy.
- Test configuration and deployment changes with controlled records before production-wide use.
- Interpret email opens and e-signatures according to their documented technical limitations.
Related guides
Was this guide useful?Your response is stored only in this browser.