Articles on: Rooms

How magic links work

Magic links are how Katalyz authenticates everyone — members of your workspace and buyers visiting rooms. Understanding how they work helps you explain the experience to buyers and troubleshoot issues.


The basics


A magic link is a unique URL sent to a specific email address. Clicking it logs that person in. That's the whole mechanism — no password, no signup form.



Three properties:


  1. Unique — generated specifically for one email address
  2. One-tap — clicking authenticates automatically
  3. Time-limited — expires after 48 hours


Behind the scenes


When someone tries to access a room:


  1. They enter their email (or it's already known from an invitation)
  2. Katalyz generates a signed token bound to that email
  3. The token is included in a URL sent via email
  4. Clicking the URL authenticates the session for that email


The token is cryptographically signed — it can't be forged or manipulated.


Why this is convenient (and where it stops short of strong security)


  • No passwords — nothing for users to remember, phish, or brute-force
  • Email-bound issuance — receiving the link requires access to the inbox at the time of issuance
  • Short expiry — links expire after 48 hours, limiting the window if intercepted


What magic links don't do on their own:


  • They are bearer tokens — anyone with the URL can use it during its validity window. Forwarded links carry the original identity.
  • They don't re-verify the holder on each use. For that, layer on Magic code verification as the room's access setting.



A magic link is bound to the email it was issued for, not to the device or person clicking it. So if someone forwards their magic link to a colleague, the colleague will be logged in as the original recipient — same identity, same permissions, same activity attribution.


This means:

  • Activity tracking gets misleading — the forward-receiver's actions are recorded under the original person's name.
  • It is NOT a security boundary — magic links should be treated as bearer credentials. Anyone who has the URL holds that identity.


If you need real per-person identity verification, use Magic code verification as the room's access setting (it requires a fresh 6-digit code on each new session, so a forwarded URL alone won't get someone in).


⚠️ Tell your buyers not to forward their personal link. It's the equivalent of forwarding a password.



  • Anyone with the link — no magic link flow; URL alone grants access
  • Authorized emails only — buyers verify email, get a personal magic link
  • Magic code verification — additional 6-digit code step before magic link is issued



Most common causes:

  • Expired (48-hour window passed)
  • Already used (one-tap only)
  • Email blocked (delivery failure)
  • User was removed from authorized list


See I didn't receive the magic link.


Updated on: 18/06/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!