I'm in the process of developing a custom login for a website. Users will not be website users with logins, but rather will be authenticated via an email and a custom token. The process should be as follows:

  • User arrives at protected page and must enter an email address ending with @acme.com
  • If user's email address ends with @acme.com, then generate a token and send them and email with link including the token.

I am trying to figure out the best way to do this in craft. My initial plan was to create a separate php script which handled the email send and token generation via AJAX, but I figured it's not best practice because it is outwith the CMS, so I should maybe develop this as a plugin.

I wondered if any of you could make some suggestions or perhaps if you'd experience such a process before might shed some light on it.


  • Do you expect users to go through this process every time they wish to log in? Oct 1, 2015 at 22:31
  • Yes, the page isn't accessed very often so I don't imagine it should be a huge problem.
    – Kyle
    Oct 8, 2015 at 10:40

1 Answer 1


Seems totally doable with a plugin.

The protected page where they enter their email address would post to a controller action in your plugin.

Your controller checks the domain of the submitted email, verifies it's from acme.com then generates a token (maybe using StringHelper::UUID() or craft()->security->generateRandomString() if it should be cryptographically secure). I'm assuming you'll save that token into the database for later verification.

You can use craft()->email->sendEmail() to send an email with the link they need to click.

When they click the link, you'd also have it point to another controller action that gets the token from the URL, verifies it's valid, then logs the user in similar to how Craft does it in UsersController->actionLogin(), but minus all of the username/password logic.

Keep in mind, if you invalidate the token after one use (which you probably should), then the user will have to go through this whole process every time they want to log in.

  • Thank you! Your guidance was invaluable, I have now built my first Craft plugin! Works a treat. The page isn't typically accessed often, so the user does have to go through the process each time the token expires.
    – Kyle
    Oct 8, 2015 at 10:39
  • Awesome! Would you mind marking as the correct answer?
    – Brad Bell
    Oct 8, 2015 at 15:38
  • Is the plugin on Github? Aug 8, 2017 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.