Magic links survive email security scanners

Sign-in links open a confirmation page before they get used, so a corporate email scanner cannot burn the link before the actual person clicks it.

If your members read club email at work, their employer’s security software may click every link in a message before it reaches them. This was quietly using up sign-in links before anybody human saw them. It was maddening to diagnose, incidentally.

Magic links now give the link top billing in the email and open a confirmation page before the token is spent, so a scanner cannot spend it for you. One-time code sessions last 30 minutes as well, and login emails with capital letters or a stray space are handled without complaint.