The magic-link token format

Every sign-in email from Green Dot contains a single link. The link is a URL whose query string carries a signed token. This document explains the token.

Structure

The token is a compact JWT with three claims: eml (SHA-256 hash of the email that requested the sign-in, prefixed with a per-server salt), jti (a 128-bit random identifier, unique per token), exp (issued-at + 900 seconds — the fifteen-minute window). No other claim. Signed with ES256 by a rotating key.

Replay protection

On first successful redemption the jti is inserted into a Redis set with the same TTL as the token. Any second attempt to redeem the same token hits the set, is refused, and returns "this link has already been used".

Corporate URL scanners

Corporate mail systems that pre-open every URL in a sandbox consume the jti before the human clicks. We detect the pattern (specific user-agent, request within a second of email delivery) and issue a second one-time token to the same email automatically, once. Beyond that we return the standard "this link has already been used" and ask the player to request a new one.