Email codes and magic links
Sign people in with a 6-digit code or a link Synq emails them.
Every brand offers sign-in with an emailed code. The person types their address, and Synq emails them a 6-digit code and a link that does the same. Either one signs them in, in the browser that asked, and verifies their address: amr is otp, and email_verified is true.
How it behaves
- Single use, 10 minutes. A code and its link work once, for 10 minutes, and the code for 5 tries. Asking again replaces both once the new email has gone.
- Bound to the sign-in. The code only works in the sign-in that asked for it, and the link only in the browser that asked: a link opened in another browser does nothing. The link opens a page whose button signs in, so a mail scanner that follows it spends nothing.
- Nobody learns who has an account. A code goes to any address, whether or not anyone there has an account, and the brand's sign-up setting decides afterwards whether someone new may join.
- Wrong codes slow down. Past each code's 5 tries, 10 wrong codes a day are free at the brand for an address, then each wait grows from a minute, and the 20th locks typed codes for that address for a day. The link in the email still works, and a right code clears the count.
- Undeliverable addresses. An address whose mail bounced or reported spam is told plainly to use another (the API's code for it is
email_undeliverable).
The email names the brand, is sent from Synq on its behalf, and tells the person never to share the code.
Going straight to it
The sign-in page lists every method. To open it at email codes, as your own "Sign in with email" button would, add synq_method=email to the authorization request, and login_hint to fill in the address.
To take the code on your app's own page instead, see Sign in from your own UI. There the email holds the code alone, with no link, since the sign-in isn't in the person's browser.
An account someone else made
If someone made an account with an address and never proved it (a password sign-up, say), a code to that address proves who really reads it. Signing in with it hands the account to that person: the address is verified, every other way in the account's maker added is removed (a password, a passkey, a wallet), and every session ends. See verified email addresses.