Your proof site is private, so we ask you to sign in before you can see it. If it tells you your code has already been used, the fix is one click.
The email we send contains a 6-digit code and a clickable link, and they are the same single-use credential. Many companies run email security software — Proofpoint, Mimecast, Microsoft Safe Links, Barracuda — that opens links in incoming mail automatically to check them for malware. When it opens that link, it spends the code before you get to it.
The sign-in it triggers is a real one. That is why refreshing usually drops you straight in.
If refreshing does not work, in order:
yourcompany.getdigitalproof.com.You stay signed in for a month, so this should be a rare chore.
The address you signed in with is not one we granted — usually a personal address, or a different alias at the same company. Tell us which address you would like to use and we will add it. We can also grant everyone at your company's domain at once, so new colleagues do not have to ask.
If people here keep hitting the used-code problem, the durable fix is to exempt these two domains from automated link scanning:
Where that setting lives, by product:
There is an alternative that needs no allowlisting: tell us, and we can turn on Google or Microsoft sign-in for your team instead, which removes the emailed code entirely. Access stays restricted to the same approved addresses — signing in with Google or Microsoft only proves who someone is, it does not widen who is allowed in.
Get in touch and we will sort it out — including granting a different address if that is easier than fighting your mail filter.