> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://katalyz.crisp.help/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How magic links work

Magic links are how Katalyz authenticates everyone — members of your workspace and buyers visiting rooms. Understanding how they work helps you explain the experience to buyers and troubleshoot issues.

## The basics

A magic link is a **unique URL sent to a specific email address**. Clicking it logs that person in. That's the whole mechanism — no password, no signup form.

## What makes a link "magic"

Three properties:

1. **Unique** — generated specifically for one email address
2. **One-tap** — clicking authenticates automatically
3. **Time-limited** — expires after 48 hours

## Behind the scenes

When someone tries to access a room:

1. They enter their email (or it's already known from an invitation)
2. Katalyz generates a **signed token** bound to that email
3. The token is included in a URL sent via email
4. Clicking the URL authenticates the session for that email

The token is cryptographically signed — it can't be forged or manipulated.

## Why this is convenient (and where it stops short of strong security)

- **No passwords** — nothing for users to remember, phish, or brute-force
- **Email-bound issuance** — receiving the link requires access to the inbox at the time of issuance
- **Short expiry** — links expire after 48 hours, limiting the window if intercepted

What magic links **don't** do on their own:

- They are **bearer tokens** — anyone with the URL can use it during its validity window. Forwarded links carry the original identity.
- They don't re-verify the holder on each use. For that, layer on **Magic code verification** as the room's access setting.

## Magic links and forwarding

A magic link is bound to the **email it was issued for**, not to the device or person clicking it. So if someone forwards their magic link to a colleague, **the colleague will be logged in as the original recipient** — same identity, same permissions, same activity attribution.

This means:
- **Activity tracking gets misleading** — the forward-receiver's actions are recorded under the original person's name.
- **It is NOT a security boundary** — magic links should be treated as bearer credentials. Anyone who has the URL holds that identity.

If you need real per-person identity verification, use **Magic code verification** as the room's access setting (it requires a fresh 6-digit code on each new session, so a forwarded URL alone won't get someone in).

> ⚠️ **Tell your buyers not to forward their personal link.** It's the equivalent of forwarding a password.

## Magic links in access settings

- **Anyone with the link** — no magic link flow; URL alone grants access
- **Authorized emails only** — buyers verify email, get a personal magic link
- **Magic code verification** — additional 6-digit code step before magic link is issued

## When magic links fail

Most common causes:
- **Expired** (48-hour window passed)
- **Already used** (one-tap only)
- **Email blocked** (delivery failure)
- **User was removed** from authorized list

See [I didn't receive the magic link](https://katalyz.crisp.help/en/article/i-didnt-receive-the-magic-link-ywjlxo/).

## Related articles
- [Magic links explained](https://katalyz.crisp.help/en/article/magic-links-explained-1ppj2yb/)
- [Choosing the right access setting](https://katalyz.crisp.help/en/article/choosing-the-right-access-setting-6jc04c/)
- [Logging in with a magic link](https://katalyz.crisp.help/en/article/logging-in-with-a-magic-link-t42xpj/)