How magic-link sign-in works

This page explains how MapleGather signs you in using a link in your email, and why it works that way.

The short version

You type your email address, select Send sign-in link, and MapleGather sends you an email with a personal link. Clicking that link signs you in automatically — no password required. The link works once and expires after 24 hours.

How it works

When you select Send sign-in link, MapleGather generates a unique, one-time token and embeds it in a link. That link is sent to your email address.

When you click the link, MapleGather checks the token:

If the token is valid and unused, you’re signed in and taken to your portal home.
If the token has expired (it’s been more than 24 hours), you see “This sign-in link has expired.” Select Request a new link to get a fresh one.
If the token has already been used (you clicked it once before, possibly on another device), you see “This sign-in link has already been used or is invalid.” Request a new link.

The link in your email comes from your organization’s email address — not from maplegather.com. This is intentional: your organization’s portal runs under their domain, so their emails come from there too.

Why it works this way

Magic-link sign-in removes the need to remember a password for a site you might visit only once or twice a year. For most members, a sign-in link that arrives in your email is faster and easier than recalling a password you set months ago.

It also protects your account: the link is personal to you, valid for 24 hours, and usable only once. Someone who doesn’t have access to your email inbox can’t use it.

Privacy: what MapleGather doesn’t tell you

When you enter an email address and select Send sign-in link, MapleGather always shows the same confirmation screen — whether or not that email address is registered. This means no one can use the sign-in page to find out which email addresses belong to your organization’s members.

If you don’t receive an email within a few minutes, it doesn’t necessarily mean your address isn’t registered — check your spam folder first, and make sure you typed the address correctly.

Edge cases & boundaries

Same link, different device: If you request a link on your phone but open it on your laptop, sign-in completes on the laptop. The phone’s sign-in screen is unaffected.
Two requests in a row: If you send two requests, only the most recent link is guaranteed valid. Using an older link from the same session may result in “already used or invalid.”
Lapsed membership: Your sign-in link still works if your membership has lapsed. You’ll land in the portal and see a message about your membership status — that’s separate from the sign-in.
Admin sign-in options: Admins have additional sign-in options (such as TOTP) available via the Admin sign-in options → link on the sign-in screen. Those options are in the Admin & Security area and not covered here.