How Magic Links Work

MentorNeko uses passwordless authentication. Instead of setting and remembering a password, you log in by clicking a secure link sent to your email address. These are called magic links, and they are the only way to access the platform.

This approach is more secure than traditional passwords and eliminates the risk of weak or reused credentials. You just need access to your email.

How to Request a Magic Link

1. Go to your organization's MentorNeko login page (the URL is specific to your organization's subdomain, for example acme.mentorneko.com).
2. Enter the email address associated with your account.
3. Click the button to send a link.
4. Check your inbox for an email from MentorNeko.
5. Click the link in the email.
6. On the verification page, click the Continue button to complete login.

The extra click on the verification page is intentional. It protects against enterprise email security scanners that automatically visit links in emails to check them for malware. By requiring you to actively click Continue, the platform ensures a scanner cannot accidentally consume your login link before you do.

Types of Magic Links

There are two kinds of links you may encounter:

Login Links

When you request a link from the login page, you receive a login link. These are valid for 15 minutes from the time they are sent and can only be used once. After you click through, the link is invalidated.

If your link expires, you can request a new one from the login page at any time.

Email Notification Links

Emails sent by the platform (session reminders, match introductions, recap emails, and similar) also contain magic links. These are a different type: they are valid for a longer period set by your organization (30 days by default) and can be used more than once.

This means you can click a link in an email from last week and still get into the platform without logging in separately. Every notification email you receive is also a seamless entry point.

Link Expiry and Auto-Resend

If you click a login link after it has expired, the platform checks whether your email address is included in the link. If it is, a fresh link is automatically sent to your inbox and you see a prompt letting you know to check your email. You do not need to go back to the login page.

If you clicked a link from another source that does not include your email, you will be prompted to return to the login page and request a new link.

A Note for Admins

If you are an organization administrator, you log in the same way as any member: by requesting a magic link from the login page. The platform automatically detects your admin role after you verify and routes you to the admin console. There is no separate admin login URL.

If you administer multiple organizations, each one has its own subdomain and you log in to each separately.

Security Considerations

• Magic links are single-use for login requests and are invalidated immediately after use.
• Links are cryptographically signed and cannot be guessed or forged.
• Your account must be in good standing to receive a link. If your account has been deactivated, the login flow will inform you to contact your program administrator.
• Sharing a magic link with someone else would give them temporary access to your account. Treat them like a password.