How does the magic link login work?
· Magic links are single-use login links sent by email — for first login and reset.
How does the magic link login work?
Magic links are single-use login links sent by email. They're more secure than passwords in email clients.
When does LACOP use magic links?
- First login after admin creates an account
- Password reset (works similarly)
- Alternative to normal password login (on request)
What's the flow?
- You request a magic link (get login link, forgot password, etc.)
- We send you an email with the link
- You click the link
- You land on a confirmation page (anti-bot protection)
- Click "Sign in now"
- You're logged in
Why two clicks?
The confirmation page is important: email clients (Outlook, Gmail, Instagram previews) often open links in the background to generate previews. Without the confirmation page the link would be consumed before you even see it.
With the confirmation button the token is only used on your active click — bots and previews can't get through.
Magic link properties
- Single-use — no longer valid after click
- Valid 24 hours — after that you need a new one
- Per account — nobody except you can use the link
- Secure — encrypted over HTTPS
Common issues
"Link doesn't work"
- Already used? — request a new link
- Expired? — >24h old, request new
- Email preview opened it? — see next point
"Instagram opens the link in the app and it doesn't work"
Instagram / Gmail / Outlook sometimes open links in an in-app browser preview that invalidates the link.
Solution:
- Long-press the link in the email (on mobile)
- Choose "Copy link"
- Paste in Safari or Chrome
- Open there
"I only see the login page after clicking"
That means the token was invalid or used. Request a new link via "Forgot password".
Tip: always use a real browser
Magic links work best in real browsers (Safari, Chrome, Firefox, Brave). Not in:
- Instagram in-app browser
- Gmail in-app browser
- Outlook preview
- Facebook in-app browser
Magic link vs password — which is better?
- Magic link: Good for first login, reset, sporadic users
- Password + 2FA: Good for regular users — faster day-to-day
From second login on you should set your password and log in with it (+ 2FA).
Questions? support@lacop.app