What it does

The app’s sign-in screen shows a link, Email me a sign-in code. The person enters
their email (or username), your site emails them a 6-digit code, and they type the code
into the app to sign in. No password is needed.

• Works for every role, administrators included. The usual role check on the app
  (“User Roles to manage”) still applies, exactly as for a password sign-in.
• Your site sends and checks its own codes. Nothing goes through a third party.
• It is as safe as Forgot Password: whoever can read the inbox could already reset
  the password.
• A code works once, expires after 10 minutes, and stops working after 5 wrong tries.
  Sending a new code cancels the previous one.
• The app never learns whether an account exists: sending always shows the same
  “If that account exists, we sent a 6-digit code to its email.” message.
• Signing in with a code marks the email as verified and activates an invited account,
  like a password reset does. It is a sign-in, so Login only apps allow it.

Turn it on or off

It is on by default.

1. Go to Mobile App Manager > App Settings.
2. Open Misc and find Sign in with an emailed code.
3. Choose No to hide the link in the app and refuse codes on the server, or Yes
   to turn it back on.

The app reads the setting as login_email_code ("yes" / "no") in the main JSON,
including before sign-in. Apps built before this feature, or a site on an older
mam-main, simply do not show the link.

The email

The email is the notification type User Roles – Sign-in Code under
Mobile App Manager > Notifications. Email is ticked by default; you can edit the
subject and text there like any other notification.

Default subject: Your sign-in code for [site_name]

Default text:

Your sign-in code is [code].

Enter it in the app to sign in. The code expires in 10 minutes.

If you didn't ask for this code, you can ignore this email. Your password has not changed.

Keep [code] in the text, or people receive an email with nothing to type.

Limits

• Up to 3 codes per account every 15 minutes, and up to 10 send requests per phone per
  hour. Past a limit the app still shows the usual message but no email is sent.
• Code entry shares the password sign-in limit (5 tries per phone in 10 minutes).

For developers

• App requests go to the existing login handler (subaction=mam_login_handler) with
  task=login_code_send + email, or task=login_code_confirm + email + code.
  A successful confirm returns the same payload as a password sign-in.
• Filter mam_login_email_code_enabled (bool) decides the feature outright.
• Auth log events (table {prefix}mam_auth_logs, provider email_code):
  login_code_sent, login_code_send_limited, login_code_send_refused,
  login_code_success, login_code_failed.

Metadata