Skip to main content

Passwordless authentication

CoolR supports email-based login using a one-time code. Users need access to their registered email account to receive a new code.

Sign in​

  1. Open the login page and enter your registered email address.
  2. Retrieve the code from your email.
  3. Enter it on the login page within 10 minutes.
  4. Select Remember me if you want to remain signed in on that device for 30 days.

For mobile screens and controls, see Mobile app login.

Sessions​

  • With Remember me, the session lasts 30 days.
  • Without it, each new session requires a new email code.
  • Users can sign in on multiple devices, each with its own session.

Removing email access prevents a user from retrieving new codes. Active sessions must also be considered when revoking access.

Security controls​

The authentication flow uses time-limited, single-use codes. The documented controls include:

  • Cryptographically secure code generation, with a minimum code length of six characters
  • Hashed code storage
  • Rate limits on verification attempts
  • Expiry and cleanup of old codes
  • Audit logs for code generation, including IP addresses
  • Secure session tokens and session revocation

Email account security is essential because access to the mailbox allows users to receive login codes. Email verification alone should not be described as an additional authentication factor.

Delivery and future options​

Email delivery can be delayed. The service uses email delivery providers such as Twilio and retries failed sending attempts.

Additional MFA for high-risk actions and code delivery through SMS or WhatsApp are listed as future options.