KSIDol documentation > KSIDol modules > SMS OTP

Module guide: SMS OTP

Non-technical user guide: what the module is for, how to use it and how it fits together with Dolibarr.

Online signatureVia SMS code (OTP)

Documents coveredQuotations, orders, invoices, contracts

CompatibilityDolibarr 18 to 24

TraceabilityEvidence file + tamper-proof log

1. Module overview

The SMS OTP module (OTP Signature) adds a reinforced electronic signature to Dolibarr: when signing a document online (quotation, order, invoice, contract), the signer receives a one-time code (OTP) by SMS on their phone. They must enter this code, then explicitly confirm their consent, before the signature area appears. The signature can therefore only be applied by a person who has actually received the SMS on the expected number, which strengthens the legal value of the agreement collected remotely. For each signature, the module automatically builds a time-stamped evidence file (document actually presented to the signer, SHA-256 fingerprint to verify that the file has not been modified, IP address, browser, mobile number, consent statement) and records each step in a tamper-proof log. The module relies on Dolibarr's native online signature and on its standard objects (third parties, quotations, orders, invoices, contracts, documents), without modifying the core of the application: it simply redirects the signing journey to its own secure page when this is enabled.

Sends a verification code (OTP) by SMS via the OVH SMS gateway before any signature
Blocks the signature until the SMS code is valid and consent is confirmed
Builds a time-stamped evidence file with document integrity control (SHA-256 fingerprint)
Keeps a tamper-proof signature log that can be viewed, filtered and exported to PDF
Enabled document by document: each type can remain on Dolibarr's native signature or switch to OTP
Makes no change to the Dolibarr core: the native journey remains available at any time

2. Online signature reinforced by SMS code

This is the module's core function: turning Dolibarr's online signature into an SMS-verified signature, without changing anything in the core of the application.

When the integration is enabled, the signing links sent to the customer from a Dolibarr record point to the module's secure signing page instead of the native page
The signer first reviews the document that will actually be taken into account, then requests a verification code by SMS
The code received by SMS must be entered and validated before the rest of the journey is unlocked
If the integration is left inactive, the link stays on Dolibarr's native signing page, with no involvement from the module
No code is sent automatically: it is the signer who triggers the sending from the public journey

3. Signer's signing journey (secure page)

The module guides the signer step by step on a dedicated public page, with several security locks before the signature.

The signer opens the presented document and confirms the mobile number that will receive the code
They enter the OTP code received by SMS; an expired or incorrect code is rejected and can be resent (within the configured limit)
Once the code is validated, they must explicitly confirm their consent (checkbox and legal statement) before the signature area appears
The signature is then applied, and the signed document and the evidence file are recorded
An already recorded signature is locked: the link no longer allows the same document to be re-signed (anti-replay protection)

4. SMS sending and OTP settings

The module handles SMS sending via an OVH SMS account and lets you fine-tune the message and the code rules.

Connection to the OVH SMS gateway (endpoint, application keys, consumer key, service), with a wizard to generate the key with the right permissions
Customizable OTP message template (automatic insertion of the code and the expiry time)
Code length (4 to 10 digits, 6 by default), validity period (1 to 60 minutes, 10 by default) and maximum number of resends are configurable
Sending settings: default sender, priority, message type (transactional/marketing), delay before sending, STOP clause
Country code handling (automatic addition, forcing a default code or no action) and test mode
Reuse of the existing settings of the SMS sending module (existing parameters are kept)

5. SMS quotas and consumption monitoring

The module lets you control SMS spending by allocating quotas and monitoring the available stock.

Allocation of an SMS quota per user, with tracking of the number allocated, used and available
Display of a badge showing the number of SMS remaining for the user
Low-stock alert (badge at the top of the screen and alert card) when the threshold is reached
Configurable top-up link to order new SMS
Display of the available credit on the OVH account

6. Evidence file and integrity control

Each signature automatically generates a set of evidence intended to demonstrate the validity of the agreement in the event of a dispute.

Storage of the exact document presented to the signer (frozen file) and of the signed document
Calculation of a SHA-256 fingerprint to verify that the document has not been modified before or after signing
Production of an evidence PDF (time-stamped evidence file) including the technical details of the signature
Creation of a downloadable evidence archive bringing together the documents, the manifest and the evidence
Data collected according to the configuration: UTC date and time, IP address, browser, mobile number, security key, document fingerprint and consent statement

7. Evidence vault (retention settings)

A dedicated tab lets you adapt the evidence archiving and retention rules to your compliance requirements.

Choice of vault mode and hashing algorithm (SHA-256 by default)
Configurable evidence retention period (in years)
Definition of a compliance scope (e.g. FR/EU) and of a legal statement presented to the signer
Enabling or not the collection of the signer's IP address and browser
Append-only log option to prevent any alteration of the records

8. Signature log and history

A History tab centralizes all signature events in a log that can be viewed and is tamper-proof.

Time-stamped list of each step: link opening, number confirmation, code sending and validation, consent, captured signature, archiving or failure
Search and filters by date, signature, third party, document type, event, status, reference, IP address or detail
Sorting and pagination of records
Direct download of the evidence PDF, the signed PDF and the evidence archive from the list
Event chaining (successive fingerprints) guaranteeing the tamper-proof nature of the log, without modifying the Dolibarr core

9. Choice by document type and diagnostics

The module is finely controlled, document type by document type, with built-in verification tools.

For each type (commercial proposal/quotation, contract, intervention sheet, order, invoice), choice between handling by SMS OTP or Dolibarr native signature
The intervention sheet, for example, is recommended as native for an on-site signature
Diagnostics button checking the endpoint, credentials, service, access to the OVH API and the presence of the required tables
Module reset tool (deletion of SMS data and logs) after confirmation
Global activation of the integration on the native online signature, enabled/disabled at any time

10. Links with Dolibarr

The module does not work in isolation: it integrates with the native building blocks of Dolibarr.

Quotations, orders, invoices, contracts : The module hooks onto Dolibarr's commercial proposal (quotation), order, invoice and contract records. The online signing link generated for these documents is redirected to the module's OTP journey when the relevant type is configured for OTP handling.
Native Dolibarr online signature : The module relies on Dolibarr's standard online signature mechanism and on its security key. It only replaces the address of the signing link (by substitution), without modifying the core: if the integration is disabled, the native journey remains fully functional.
Third parties and contacts : The module reuses the name of the third party and the signer's phone number attached to the document to send the SMS and display it in the log. The mobile number can be confirmed or corrected during the signing journey.
Documents (Dolibarr files) : The presented document, the signed document and the evidence archive are stored in Dolibarr's documents area, in a directory dedicated to the module, and remain downloadable from the history.
Users and access rights : The module relies on Dolibarr's user accounts for SMS quotas and on the rights (read, write, administration) for access to the configuration and the history. Access to the configuration is reserved for administrators.
Validation events (triggers) : The module reacts to Dolibarr's standard events on documents (validation of a quotation, an order or an invoice, signing of a proposal, modification of a contract) to maintain the consistency of the signing journey.