# What is a magic link?

> A magic link is a secure, single-purpose link that gives access without a password. How it works for client timesheet approval and why it is safe.

URL: https://timetracking.tech/glossary/magic-link
Language: en
Last updated: 2026-10-24

**Definition:** A magic link is a unique, hard-to-guess link sent to someone by email that gives access to a specific page or task without a password. It is often used for sign-in and for one-off actions such as approving a timesheet.

## How magic links work

The link contains a long random token that the server recognises. Opening it proves the person has access to that email inbox, which is the same thing a password reset relies on. Good magic links are limited in scope, expire after a while and can be combined with a second check, such as a one-time code sent to the same email address before an important action is confirmed.

For people who use a system only occasionally, like a client contact who approves hours once a week, a magic link removes the biggest hurdle: creating and remembering yet another account.

## Magic links in TimeTracking

TimeTracking sends client approvers a secure magic link for their hours. The link opens only the hours for that client, and the approver signs with a one-time code sent to their email. The token never leaks through the referrer header, and every approval is recorded in the audit log.

- [Client approval](https://timetracking.tech/glossary/client-approval)
- [Client approval feature](https://timetracking.tech/features/client-approval)
- [Audit trail](https://timetracking.tech/glossary/audit-trail)