Drıftstack docs
Docs

Sign in with an email link (magic link): invalid, expired or already used

You might be here because: “magic link says invalid, expired, or already used” · “sign-in link doesn’t work” · “I got two sign-in emails, which one” · “the link signed me in and removed my password” · “choose which account to use” · “email link asks for a two-factor code” · “link already accepted but I’m not signed in”

Short answer

A magic link is a single-use sign-in token that expires after 60 minutes; requesting a new one does not cancel the old one: each works until it expires, and using any one retires the rest. “This link is invalid, expired, or already used” means exactly that — request a fresh link and open the newest email.

Check first

  • Opened the newest email? Two requests (a double-click sends two) mint two links, and only the latest is valid.
  • Under 60 minutes since you requested it?
  • Site storage allowed in this browser? The page refuses to sign you in without it, but the link still works once you allow it.

Likely causes and fixes

  1. Invalid/expired/used. Go back to Sign in with a magic link instead and request another. Requests are limited to 3 per minute per network address. No email at all? See Didn’t get the verification, sign-in, reset or invite email. The request page never reveals whether the address has an account.
  2. “The request took too long, so the email may already be on its way.” Check inbox and spam before requesting again; if several arrive, use the newest.
  3. “Your sign-in link was accepted, but your browser couldn’t finish signing you in.” The link is spent. Request a fresh one.
  4. “The request took too long, so this link may already have been used.” Same: don’t retry that link, request a new one.
  5. “Choose which account to use.” You’re already signed in as someone else in this browser; pick whether to keep that session or use the link.
  6. Asked for a two-factor code. Normal for accounts with two-factor on; enter it within the time shown.
  7. “You’re signed in” plus a note that your password was removed. The link was the first confirmation of your address and your account had a password set before confirmation, so the password was removed and you were emailed about it. Set a new one with a password reset from the page’s offer.

If it still fails

Press Talk to a person in this chat (or open Help) and include the address, the sentence shown, and the time you requested the link. If a sign-in email arrived that you did not request, say so — that goes to a person as a security matter.