{
  "id": 18640529,
  "title": "No-login magic links for field crews: hashed, scoped, revocable, and usable offline",
  "url": "https://urgent.news/2026/11/07/no-login-magic-links-for-field-crews-hashed-scoped-revocable-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T05:01:46.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ahmad_dogar_7d098f5e48f72/no-login-magic-links-for-field-crews-hashed-scoped-revocable-and-usable-offline-2fba"
  },
  "original_language": "en",
  "account": "Yardline facilitates the transition of a building supplier's materials to a contractor, with a crew lead on site confirming the delivery, noting any damages, and signing off. Typically, the crew lead possesses minimal signal strength and no desire to create an account. To streamline the process, Yardline provides a link that the crew can tap to see the delivery and mark it as received, without requiring a password, app installation, or sign-up. This article focuses on securing this link, ensuring it remains safe for distribution via text message and functional even when the phone is offline. Key requirements for such a link include single-use, automatic expiration after a week, revocation by the office, and offline usability. The link is equivalent to a password transmitted in plain text through SMS threads, group chats, or forwarded screenshots. Initial design considerations include limiting access to a single delivery, expiring automatically in seven days, the ability for the office to revoke the link at any time, non-replicability in the event of a database breach, and traceability of actions to the crew member using the link. To generate a secure link, the system creates a 32-byte random token using the operating system's random number generator, which is then hashed with SHA-256 and stored securely. The link is issued to a temporary guest user with the 'crew_lead' role, bound to the contractor's account. Each action performed through the link is logged under 'Jobsite crew,' ensuring the office user responsible for the link is never held accountable for the crew's actions. The link's URL is configured to be excluded from search engine indexing. Upon each request, the system re-verifies the token to ensure its validity, preventing unauthorized access.",
  "summary": "Yardline handles the handoff between a building supplier and a contractor: a truck arrives on site, someone has to confirm what came off it, note what is missing or damaged, and sign. That someone is usually a crew lead standing on a roof or in a driveway, in gloves, with one bar of signal, who has never heard of Yardline and has no interest in creating an account. So the crew gets a link…",
  "key_points": [
    "Yardline provides no-login magic links for field crews to confirm deliveries.",
    "Links are hashed, scoped, revocable, and usable offline with single-use and 7-day expiration.",
    "System logs actions under Jobsite crew to ensure office accountability."
  ],
  "editors_take": "Eliminating the need for accounts and passwords prioritizes field efficiency while using hashed, scoped tokens to prevent unauthorized access during the high-risk handoff of building materials.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}