Magic-Link Login: What It Is and When a Shop Should Use It
By Alva Chew · Updated
Definition A magic-link login lets a customer sign in by tapping a single-use link sent to their email, with no password to create or remember. It is the simplest passwordless method for a loyalty card, because the customer already has the inbox. For a points-only programme it keeps sign-in as simple as the reward.
What is a magic-link login?
A magic-link login is a way to sign in with an email link instead of a password. The customer types their email address, the system sends a link, and tapping the link opens their account. It is one kind of passwordless login.
For a shop, the benefit is that the customer never has to invent a secret at the counter. They need only the email address they already use.
How does a magic-link login work?
- The customer enters their email address on your sign-in page.
- The system generates a random secret and builds a link around it.
- The link is emailed to the customer.
- The customer taps the link on their phone.
- The system checks the secret, marks it used and signs the customer in.
Two properties matter most, and both come from public security guidance.
| Property | What the guidance says | Source |
|---|---|---|
| Single use | Verifiers “SHALL accept a given authentication secret as valid only once during the validity period” | NIST SP 800-63B, section 3.1.3.2 |
| Short life | Authentication “SHALL be considered invalid unless completed within 10 minutes” | NIST SP 800-63B, section 3.1.3.2 |
| Random | Secrets should be generated with a cryptographically secure random number generator | OWASP Forgot Password Cheat Sheet |
| Expiry and invalidation | Tokens should “expire after an appropriate period” and be invalidated after use | OWASP Forgot Password Cheat Sheet |
Sources: NIST SP 800-63B, Digital Identity Guidelines, checked 7 November 2026. OWASP Forgot Password Cheat Sheet, checked 7 November 2026. OWASP’s sheet covers password-reset tokens, not login links, so read it as a guide to the same kind of token.
Is a magic-link login secure?
It depends on the inbox. NIST says “Email SHALL NOT be used for out-of-band authentication” because email may be intercepted or reached by someone who only has the account password. NIST writes that rule for systems that guard valuable accounts. Confirmation codes sent only to validate an email address are outside it.
A loyalty card holds a points balance. The risk is lower, so a short-lived, single-use emailed link is a proportionate choice. If your programme held payment details, you would want a stronger method such as a passkey.
Do customers need an app?
No. The link opens in the phone’s browser, which is why it suits a loyalty card with no app download. Customers join by scanning a QR code and later sign in with the same email.
What can go wrong?
- The email lands in spam. Tell customers to check there and request a new link.
- The customer opens the link on a different device than the one they started on. A good system handles this, so test it.
- The link has expired. A new request should issue a fresh link and cancel the old one.
- The customer mistyped the address. Show the address on screen before sending.
Which sign-in suits a points-only loyalty programme?
A magic-link login suits most shops. A points-only programme works because customers already understand spend, earn and redeem, and the sign-in should ask for no more than that. Passwords, security questions and extra steps add rules, in the way stamps, tiers and vouchers do on the reward side. Your digital loyalty card then opens in one tap.
Magic-link login and Gimify
Gimify members sign in with a one-tap email link, after joining by QR code and email with no password and no app download. The card then lives in Google Wallet with a live balance.
Questions owners ask
What is a magic-link login?
A sign-in method where the customer enters their email address and receives a link. Tapping the link signs them in. No password is created, remembered or typed.
How does a magic-link login work?
The system generates a random, single-use secret, puts it in a link and emails it. When the customer opens the link, the system checks the secret, marks it used and starts the session.
Is a magic-link login secure?
It is as secure as the customer's email account. NIST says email should not be used for out-of-band authentication on high-value accounts, so a link suits low-stakes accounts such as a points balance better than a bank login.
How long should a magic-link login last?
Briefly. NIST treats an out-of-band authentication as invalid unless it is completed within 10 minutes, and OWASP advises that reset tokens expire after an appropriate period.
Do customers need an app for a magic-link login?
No. The link opens in the phone's browser, so the customer installs nothing.
What if the customer never receives the email?
They can request a new link, which replaces the old one. Checking the spam folder and confirming the address was typed correctly solve most cases.
Read next
Start free
Gimify is free for one outlet with unlimited members and no time limit. Unlimited outlets are one flat monthly price.
See plans