email_code_login

Email code login lets visitors sign in or create an account by entering their email address and a one-time numeric code
sent to it. No password to remember, no magic link that has to be opened on the right device. A password tab is available too,
for people who prefer it.

Features

• Sign-in and sign-up pages with a code sent by email; an optional password tab.
• Accounts are created only after the code is confirmed, with an optional or required password and a consent
  checkbox.
• Email change confirmed by a code sent to the new address.
• A "verified email" flag other modules can rely on, for example before linking social accounts by email.
• Optional sign-in dialog built on the native HTML dialog element, with progressive enhancement: plain pages keep working
  without JavaScript.
• Security: no account enumeration, codes stored only as HMAC and usable once, rate limits per IP and per address via core
  flood control, flows bound to the browser by a cookie, cross-site POSTs refused.
• Extensible: events for account pre-create, created, login, email and password changes (the login event can set the
  landing page), and an alter hook for the sign-up step.

Post-Installation

Go to Configuration → People → Email code login to set the code length and lifetime, sending limits, whether
unknown addresses may create accounts, the password mode (none, optional, required), the consent checkbox text and link, and
the email text. Make sure the site can send mail. Links to the sign-in pages can open the dialog when they carry the
data-ecl-modal attribute.

Additional Requirements

Drupal core only (10.3 or 11). A working mail transport.

Recommended modules/libraries

Any SMTP or transactional mail module (for example Symfony Mailer) for reliable delivery of codes.

Similar projects

• Magic Login sends a link or a code; Email code login adds rate
  limits per address, protection against account enumeration and email change confirmed by a code.
• Passwordless sends login links instead of codes.
• Magic Login Link sends one-time login links.
• Email OTP Login signs in existing users only, without
  sign-up.
• Email OTP adds a code as a second factor after the password;
  Email code login replaces the password with a code.
• TFA provides two-factor authentication on top of the password.

Community Documentation

See README.md in the module for configuration, security notes and extension points.