Articles on: Rooms

How magic links work

Magic links are how Katalyz authenticates everyone — members of your workspace and buyers visiting rooms. Understanding how they work helps you explain the experience to buyers and troubleshoot issues.


The basics


A magic link is a unique URL sent to a specific email address. Clicking it logs that person in. That's the whole mechanism — no password, no signup form.



Three properties:


  1. Unique — generated specifically for one email address
  2. One-tap — clicking authenticates automatically
  3. Time-limited — expires after 48 hours


Behind the scenes


When someone tries to access a room:


  1. They enter their email (or it's already known from an invitation)
  2. Katalyz generates a signed token bound to that email
  3. The token is included in a URL sent via email
  4. Clicking the URL authenticates the session for that email


The token is cryptographically signed — it can't be forged or manipulated.


The room login page


When a visitor arrives via the plain room URL instead of their personal link, they see the room's login page, branded with your logo and theirs:


  • Join the conversation. — "Enter your email to step inside." (or Welcome back. — "Enter your email to pick up where you left off." on a return visit)
  • One field: Work email, then Continue. A note reads "By continuing, you agree to Katalyz's terms of service."
  • For rooms set to Access code verification, a second screen — Check your inbox. — asks for the Access code (6 digits) with Verify & access.


Name and role are not part of login. About a minute after entering, a small Mind introducing yourself? card ("So the team knows who's in the room. Optional.") offers First name / Last name / Job title with Not now / Save. Visitors can also fill it in later from their avatar in the top bar (Complete your profile).


Room login page with both logos, "Join the conversation." and the Work email field


Why this is convenient (and where it stops short of strong security)


  • No passwords — nothing for users to remember, phish, or brute-force
  • Email-bound issuance — receiving the link requires access to the inbox at the time of issuance
  • Short expiry — links expire after 48 hours, limiting the window if intercepted


What magic links don't do on their own:


  • They are bearer tokens — anyone with the URL can use it during its validity window. Forwarded links carry the original identity.
  • They don't re-verify the holder on each use. For that, layer on Access code verification as the room's access setting.



A magic link is bound to the email it was issued for, not to the device or person clicking it. So if someone forwards their magic link to a colleague, the colleague will be logged in as the original recipient — same identity, same permissions, same activity attribution.


This means:

  • Activity tracking gets misleading — the forward-receiver's actions are recorded under the original person's name.
  • It is NOT a security boundary — magic links should be treated as bearer credentials. Anyone who has the URL holds that identity.


If you need real per-person identity verification, use Access code verification as the room's access setting (it requires a fresh 6-digit code on each new session, so a forwarded URL alone won't get someone in).


⚠️ Tell your buyers not to forward their personal link. It's the equivalent of forwarding a password.



  • Anyone with the link — plain-URL visitors type an email on the login page; no verification
  • Only authorized users — the email typed on the login page must match your list or an allowed domain
  • Access code verification — additional 6-digit code step before the session is opened


See Choosing the right access setting.



Most common causes:

  • Expired (48-hour window passed)
  • Already used (one-tap only)
  • Email blocked (delivery failure)
  • User was removed from the authorized list


See I didn't receive the magic link.


Updated on: 04/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!