My Login Link and My Unsubscribe Link Are the Same Kind of String
Upwork Scout has no password field. It never had one. When I was sketching the signup flow I told myself I was removing work: no hashing, no reset flow, no rules about symbols and capital letters, no breach surface built out of passwords people reused from somewhere else. That held for about a week. Then I looked at what I had actually done. I had not removed the work. I had moved all of it into…
Upwork Scout's signup flow introduced passwordless authentication, moving all authentication work into a single file. The auth layer consists of three types of links: a login link, a session (cookie), and an unsubscribe link. All three are signed JWTs using the same secret.
The verification function ensures that only the correct type of token is accepted. A short-lived magic link (15 minutes) caters to inboxes being shared or forwarded, while a longer-lived unsubscribe link (365 days) exists to help users stop receiving emails. The user ID is derived from the email address and serves as a deterministic identifier, not a secret.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
