How magic-link sign-in works

This page explains how MapleGather signs you in using a link in your email, and why it works that way.

Not available in this version. MapleGather sends no member sign-in emails yet. A live site’s sign-in page shows “Email sign-in isn’t available yet — it’s coming in an update.” instead of the email form; a test site that still shows the form answers Send sign-in link with Check your email, but sends nothing. This page describes how email-link sign-in will work once it is available. Admins and board members sign in with Sign in with a password.

The short version

You type your email address and select Send sign-in link. If MapleGather issues a member sign-in link for that address, it emails the personal link to you. Selecting a member sign-in link you receive signs you in automatically — no password required. The link works once and expires after 15 minutes by default. Your organization can set a different expiry time.

How it works

When MapleGather issues a member sign-in link, it generates a unique, one-time token, embeds it in the link, and sends it to that address. The sign-in screen does not tell you whether a link was issued.

When you click the link, MapleGather checks the token:

If the token is valid and unused, you’re signed in and taken to your portal home.
If the token has expired (after your organization’s configured time, 15 minutes by default), you see “This sign-in link has expired.” Select Request a new link to request a replacement.
If the token has already been used (you clicked it once before, possibly on another device), you see “This sign-in link has already been used or is invalid.” Request a new link.

The link in your email comes from your organization’s email address — not from maplegather.com. This is intentional: your organization’s portal runs under their domain, so their emails come from there too.

Why it works this way

Magic-link sign-in removes the need to remember a password for a site you might visit only once or twice a year. For most members, a sign-in link that arrives in your email is faster and easier than recalling a password you set months ago.

It also protects your account: the link is personal to you, valid for 15 minutes by default, and usable only once. Someone who doesn’t have access to your email inbox can’t use it.

Privacy: what MapleGather doesn’t tell you

When you enter an email address and select Send sign-in link, MapleGather always shows the same “Check your email” confirmation screen — whether the address identifies one eligible account, no eligible account, or multiple eligible accounts. No link is issued when the address has no match or multiple matches. The screen does not reveal which case occurred, so no one can use it to find out which email addresses belong to your organization’s accounts.

In this version no email arrives for any address, so a missing email tells you nothing about whether your address is registered; checking your spam folder won’t find one.

Edge cases & boundaries

Same link, different device: If you request a link on your phone but open it on your laptop, sign-in completes on the laptop. The phone’s sign-in screen is unaffected.
Two requests in a row: If you send two requests, only the most recent link is guaranteed valid. Using an older link from the same session may result in “already used or invalid.”
Lapsed membership: Your sign-in link still works if your membership has lapsed. You’ll land in the portal and see a message about your membership status — that’s separate from the sign-in.
Admin and board member sign-in: Select Sign in with a password on the sign-in page. MapleGather takes you to your organization’s sign-in service to complete sign-in. This article covers member email-link sign-in.