Safer Sign-In: Single-Use Links, Verified Emails and Email Changes by Code
The Momor Team · Oct 31, 2026 · 3 min read
Your Momor account now holds credits, organizations and, for some of you, provider keys. That raises the stakes on how you get into it. This round of work tightens every way in, without adding a password.
Highlights
- Sign-in links work once, and a newer link replaces the older one
- Google and Apple sign-ins are accepted only with a verified email
- Changing your email needs a sign-in in the last five minutes and a code
- Sensitive changes ask you to prove it is you, right then
Links that work once
The link in a sign-in email now carries a single protected token and nothing else, not even your email address. It works once: signing in uses it up, and asking for a new link cancels the old one. Links still expire after a short window, and the six-digit code works exactly as before.
Verified emails only
A Google or Apple sign-in is accepted only when the provider says it has verified the address. Google is taken at its word for Gmail addresses and for addresses in a Google Workspace organization. For any other address, a Google sign-in never opens an account that another sign-in method already holds; you sign in there with a code sent to the address instead.
Proving it is you, right then
Email changes now happen inside the app, in your Profile settings, with codes instead of emailed links. You need to have signed in within the last five minutes. Momor sends a six-digit code to the new address, and once you enter it, the change goes through, you are signed out, and both the old and new addresses are told.
The same recent-sign-in rule guards other sensitive changes, such as adding, replacing or removing a provider key. If it has been more than five minutes, Momor emails you a code to confirm.
Why This Matters
A sign-in link that keeps working, or an account that a lookalike sign-in could open, is a way in for someone who is not you. Each of these changes closes one of those doors while keeping sign-in as quick as it was.
What this means for you: sign in the same way you always have, and know that a forwarded link, an unverified address or a stale session can no longer be used to take over your account.