> For the complete documentation index, see [llms.txt](https://docs.mdintegrations.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mdintegrations.com/changelog/2026/magic-link-authentication-for-patient-workflows.md).

# Magic-Link Authentication for Patient Workflows

*Released September 18, 2026 (UAT available September 18, 2026)*

> **Breaking change:** API endpoints will no longer return 2FA codes for white-label partners. If your integration reads 2FA codes from the API, update it before this change reaches production.

This release updates how patients access intake forms and white-label workflows, to improve security and simplify login.

## \[What's Changing]

* White-label partners transition from two-factor authentication to magic-link-based access; API endpoints will no longer return 2FA codes
* All links sent to patients or returned via the API use opaque, non-identifiable tokens — no voucher IDs, patient IDs, or emails appear in URLs
* Embedded workflows require no changes — your existing implementation continues to work

## \[Why]

Current URLs expose identifiable information and can be reused without verification. The new model prevents link leakage, protects patient data, and ensures links can't be decoded or reused across devices.

## \[How the New Flow Works]

1. Your system or MDI's system generates a single-use magic link containing only a secure hash
2. When the patient opens the link, the request is verified (browser checks, usage signals, headers)
3. If valid, the token is invalidated, a session cookie is set, and the patient is redirected to the correct voucher/workflow
4. If the link is reused without a valid session, the patient sees an error and can request a new link
5. If a patient tries the same link on a different device, they're prompted to request a new token
6. Any newly requested link always leads to the same voucher/workflow as the original, so the destination stays consistent


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mdintegrations.com/changelog/2026/magic-link-authentication-for-patient-workflows.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.