Security (PRO)
How Can I Control How Many Times A Magic Link Can Be Used?
Quick Answer
This is a Pro feature. When you create a Magic Link from the admin, set Usage Limit to the number of times it may be redeemed. Set 0 for a link that never runs out.
Why This Helps
By default a magic link is single use: the first person to open it is logged in, and the link is spent. That is the right behaviour for a login emailed to one person, and you should leave it alone in that case.
But not every link is sent to one person:
- Shared access for a small group. Give three reviewers one link and set the limit to 3, instead of generating and tracking three separate links.
- A link that survives an email client. Some corporate mail systems and security scanners open links before the recipient does. A limit of 2 gives the real person a working link even if something else touched it first.
- A standing link for a kiosk or shared device. Set
0and the same link keeps working for as long as it has not expired.
The limit is set per link, at the moment you create it, so one site can have single-use links for logins and a multi-use link for a shared workflow.
How To Set A Usage Limit
- Go to
Magic Link -> Magic Links. - Click Generate New.
- Choose the user and the token lifespan as usual.
- In Usage Limit, enter the number of times the link may be used.
- Create the link.
The field only appears in Pro. In the free version every link is single use.
What The Numbers Mean
| Value | Behaviour |
|---|---|
1 |
Single use. The link is spent the first time it is opened. This is the default. |
3 |
Works three times, then stops. |
0 |
Unlimited. Works until the link expires. |
A link is only marked as used once its allowance is gone. A link with a limit of 3 that has been opened twice still shows as active, because it still works.
Expiry Still Applies
The usage limit and the expiry time are separate, and whichever runs out first wins.
A link with a limit of 0 and a lifespan of 15 minutes still stops working after 15 minutes. If you want a link that lasts, give it both a high limit and a long lifespan. See Set Magic Link expiry.
Use Unlimited Links Carefully
A link set to 0 is a working key to that account for as long as it is valid. Anyone who has the URL can use it, as many times as they like.
Before you create one:
- Keep the lifespan short. An unlimited link that expires in an hour is a very different risk from one that lasts a month.
- Do not send unlimited links by email if you can avoid it — email is forwarded, archived, and scanned.
- Use them for low-privilege accounts, not administrators.
- Revoke the link as soon as the job is done rather than waiting for it to expire. See Manage Magic Links.