Magic links: use an interstitial confirm page

Tip from @elvissun: corporate email scanners pre-fetch links and burn single-use magic-link tokens, so the email should point to a confirm page whose button POSTs to the verify API.

@elvissun on twitter

if your saas uses magic link signup, check this right now:

your link in the email shouldn’t call the verify api directly.

there should be an interstitial confirm page instead.

here’s why:

corporate email scanners (microsoft safe links, mimecast, etc) pre-fetch every url in incoming mail. they burn your single-use token before the user even clicks.

then user opens the email, sees “token invalid”, retry 2 times, gives up.

cost us two F500 leads before we caught it.

fix: email points to a page with a “sign me in” button → POST from that button hits your verify api.

Similar in the index